From 22cfddc2a0343cdbef7f1263830c2dacaa75f22e Mon Sep 17 00:00:00 2001
From: Sonic Zhang <sonic.zhang@analog.com>
Date: Wed, 10 Dec 2014 18:20:53 +0800
Subject: [PATCH] memmove_wd: copy chunk down from big address if parameter to
 is larger than from

When watchdog is enabled, memmove_wd() always copy chunk up from small address.
This damanges overlapped memory data if destination address is smaller than
source address.

Signed-off-by: Sonic Zhang <sonic.zhang@analog.com>
Acked-by: Simon Glass <sjg@chromium.org>
---
 common/image.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/common/image.c b/common/image.c
index b75a5ce29a..e691a51789 100644
--- a/common/image.c
+++ b/common/image.c
@@ -485,12 +485,22 @@ void memmove_wd(void *to, void *from, size_t len, ulong chunksz)
 		return;
 
 #if defined(CONFIG_HW_WATCHDOG) || defined(CONFIG_WATCHDOG)
+	if (to > from) {
+		from += len;
+		to += len;
+	}
 	while (len > 0) {
 		size_t tail = (len > chunksz) ? chunksz : len;
 		WATCHDOG_RESET();
+		if (to > from) {
+			to -= tail;
+			from -= tail;
+		}
 		memmove(to, from, tail);
-		to += tail;
-		from += tail;
+		if (to < from) {
+			to += tail;
+			from += tail;
+		}
 		len -= tail;
 	}
 #else	/* !(CONFIG_HW_WATCHDOG || CONFIG_WATCHDOG) */
-- 
2.39.5