1 files changed, 8 insertions, 3 deletions

diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c
index fae7ffade9c9..47e0b2d232e3 100644
--- a/net/rfkill/rfkill.c
+++ b/net/rfkill/rfkill.c
@@ -201,6 +201,8 @@ static int rfkill_toggle_radio(struct rfkill *rfkill,
                  * BLOCK even a transmitter that is already in state
                  * RFKILL_STATE_HARD_BLOCKED */
                 break;
+        default:
+                return -EINVAL;
         }
 
         if (force || state != rfkill->state) {
@@ -234,6 +236,9 @@ static void __rfkill_switch_all(const enum rfkill_type type,
 {
         struct rfkill *rfkill;
 
+        if (unlikely(state >= RFKILL_STATE_MAX))
+                return;
+
         rfkill_global_states[type].current_state = state;
         list_for_each_entry(rfkill, &rfkill_list, node) {
                 if ((!rfkill->user_claim) && (rfkill->type == type)) {
@@ -329,9 +334,7 @@ int rfkill_force_state(struct rfkill *rfkill, enum rfkill_state state)
 {
         enum rfkill_state oldstate;
 
-        if (state != RFKILL_STATE_SOFT_BLOCKED &&
-            state != RFKILL_STATE_UNBLOCKED &&
-            state != RFKILL_STATE_HARD_BLOCKED)
+        if (unlikely(state >= RFKILL_STATE_MAX))
                 return -EINVAL;
 
         mutex_lock(&rfkill->mutex);
@@ -727,6 +730,8 @@ int __must_check rfkill_register(struct rfkill *rfkill)
                 return -EINVAL;
         if (rfkill->type >= RFKILL_TYPE_MAX)
                 return -EINVAL;
+        if (rfkill->state >= RFKILL_STATE_MAX)
+                return -EINVAL;
 
         snprintf(dev->bus_id, sizeof(dev->bus_id),
                  "rfkill%ld", (long)atomic_inc_return(&rfkill_no) - 1);