From f7002c55fc9736abdc5628380e3d3087c51af10e Mon Sep 17 00:00:00 2001
From: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
Date: Sat, 2 Aug 2008 15:11:00 -0300
Subject: [PATCH] --- yaml --- r: 111199 b: refs/heads/master c:
 96c87607ac8f9b0e641d11ba6e57f8ec0214ea1c h: refs/heads/master i:   111197:
 8812aaa8b5a1c83c4ded8179e4b3ed3b7aade85d   111195:
 a7f3c732e0979af0ffdec40c1b9a3abbd5d61336   111191:
 a2681d015ecba29e7692cb3cd0338c3842c8c81f   111183:
 4cf077d58b8be018835ebea27c2985f74dcf801d   111167:
 86471e5e50f291973556a822b96acc356e531df8 v: v3

---
 [refs]                       |  2 +-
 trunk/include/linux/rfkill.h |  1 +
 trunk/net/rfkill/rfkill.c    | 11 ++++++++---
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/[refs] b/[refs]
index 7256271ea9c8..bf48b62f1858 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 77fba13ccc3a2a3db100892a4a6cc5e2f8290cc7
+refs/heads/master: 96c87607ac8f9b0e641d11ba6e57f8ec0214ea1c
diff --git a/trunk/include/linux/rfkill.h b/trunk/include/linux/rfkill.h
index e92d8e94bb88..4cd64b0d9825 100644
--- a/trunk/include/linux/rfkill.h
+++ b/trunk/include/linux/rfkill.h
@@ -49,6 +49,7 @@ enum rfkill_state {
 	RFKILL_STATE_SOFT_BLOCKED = 0,	/* Radio output blocked */
 	RFKILL_STATE_UNBLOCKED    = 1,	/* Radio output allowed */
 	RFKILL_STATE_HARD_BLOCKED = 2,	/* Output blocked, non-overrideable */
+	RFKILL_STATE_MAX,		/* marker for last valid state */
 };
 
 /*
diff --git a/trunk/net/rfkill/rfkill.c b/trunk/net/rfkill/rfkill.c
index fae7ffade9c9..47e0b2d232e3 100644
--- a/trunk/net/rfkill/rfkill.c
+++ b/trunk/net/rfkill/rfkill.c
@@ -201,6 +201,8 @@ static int rfkill_toggle_radio(struct rfkill *rfkill,
 		 * BLOCK even a transmitter that is already in state
 		 * RFKILL_STATE_HARD_BLOCKED */
 		break;
+	default:
+		return -EINVAL;
 	}
 
 	if (force || state != rfkill->state) {
@@ -234,6 +236,9 @@ static void __rfkill_switch_all(const enum rfkill_type type,
 {
 	struct rfkill *rfkill;
 
+	if (unlikely(state >= RFKILL_STATE_MAX))
+		return;
+
 	rfkill_global_states[type].current_state = state;
 	list_for_each_entry(rfkill, &rfkill_list, node) {
 		if ((!rfkill->user_claim) && (rfkill->type == type)) {
@@ -329,9 +334,7 @@ int rfkill_force_state(struct rfkill *rfkill, enum rfkill_state state)
 {
 	enum rfkill_state oldstate;
 
-	if (state != RFKILL_STATE_SOFT_BLOCKED &&
-	    state != RFKILL_STATE_UNBLOCKED &&
-	    state != RFKILL_STATE_HARD_BLOCKED)
+	if (unlikely(state >= RFKILL_STATE_MAX))
 		return -EINVAL;
 
 	mutex_lock(&rfkill->mutex);
@@ -727,6 +730,8 @@ int __must_check rfkill_register(struct rfkill *rfkill)
 		return -EINVAL;
 	if (rfkill->type >= RFKILL_TYPE_MAX)
 		return -EINVAL;
+	if (rfkill->state >= RFKILL_STATE_MAX)
+		return -EINVAL;
 
 	snprintf(dev->bus_id, sizeof(dev->bus_id),
 		 "rfkill%ld", (long)atomic_inc_return(&rfkill_no) - 1);