diff --git a/[refs] b/[refs]
index e4313b41b751..46bbe00ec358 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 74523c901342a773ddd9f14c14539ec3d4197ecf
+refs/heads/master: 6594d87ebd8371f4b67f7ab4b68f172b139b78d6
diff --git a/trunk/drivers/acpi/fan.c b/trunk/drivers/acpi/fan.c
index 6cf10cbc1eee..55c17afbe669 100644
--- a/trunk/drivers/acpi/fan.c
+++ b/trunk/drivers/acpi/fan.c
@@ -148,7 +148,7 @@ acpi_fan_write_state(struct file *file, const char __user * buffer,
 	int result = 0;
 	struct seq_file *m = file->private_data;
 	struct acpi_device *device = m->private;
-	char state_string[12] = { '\0' };
+	char state_string[3] = { '\0' };
 
 	if (count > sizeof(state_string) - 1)
 		return -EINVAL;
@@ -157,6 +157,12 @@ acpi_fan_write_state(struct file *file, const char __user * buffer,
 		return -EFAULT;
 
 	state_string[count] = '\0';
+	if ((state_string[0] < '0') || (state_string[0] > '3'))
+		return -EINVAL;
+	if (state_string[1] == '\n')
+		state_string[1] = '\0';
+	if (state_string[1] != '\0')
+		return -EINVAL;
 
 	result = acpi_bus_set_power(device->handle,
 				    simple_strtoul(state_string, NULL, 0));