1 files changed, 30 insertions, 0 deletions
diff --git a/target/linux/brcm63xx/patches-4.9/001-4.11-01-mtd-m25p80-consider-max-message-size-in-m25p80_read.patch b/target/linux/brcm63xx/patches-4.9/001-4.11-01-mtd-m25p80-consider-max-message-size-in-m25p80_read.patch
new file mode 100644
index 0000000000..e90270156e
--- /dev/null
+++ b/target/linux/brcm63xx/patches-4.9/001-4.11-01-mtd-m25p80-consider-max-message-size-in-m25p80_read.patch
@@ -0,0 +1,30 @@
+From 80a79a889ce5df16c5261ab2f1e8e63b94b78102 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Fri, 28 Oct 2016 07:58:46 +0200
+Subject: [PATCH 1/8] mtd: m25p80: consider max message size in m25p80_read
+
+Consider a message size limit when calculating the maximum amount
+of data that can be read.
+
+The message size limit has been introduced with 4.9, so cc it
+to stable.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Cc: <stable@vger.kernel.org> # 4.9.x
+Signed-off-by: Cyrille Pitchen <cyrille.pitchen@atmel.com>
+---
+ drivers/mtd/devices/m25p80.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/devices/m25p80.c
++++ b/drivers/mtd/devices/m25p80.c
+@@ -172,7 +172,8 @@ static ssize_t m25p80_read(struct spi_no
+ 
+ 	t[1].rx_buf = buf;
+ 	t[1].rx_nbits = m25p80_rx_nbits(nor);
+-	t[1].len = min(len, spi_max_transfer_size(spi));
++	t[1].len = min3(len, spi_max_transfer_size(spi),
++			spi_max_message_size(spi) - t[0].len);
+ 	spi_message_add_tail(&t[1], &m);
+ 
+ 	ret = spi_sync(spi, &m);