4 files changed, 34 insertions, 0 deletions

diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index 01628f0c9a0c..7205268b30bc 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -5780,6 +5780,32 @@ del_cursor:
         return error;
 }
 
+/* Make sure we won't be right-shifting an extent past the maximum bound. */
+int
+xfs_bmap_can_insert_extents(
+        struct xfs_inode        *ip,
+        xfs_fileoff_t           off,
+        xfs_fileoff_t           shift)
+{
+        struct xfs_bmbt_irec    got;
+        int                     is_empty;
+        int                     error = 0;
+
+        ASSERT(xfs_isilocked(ip, XFS_IOLOCK_EXCL));
+
+        if (XFS_FORCED_SHUTDOWN(ip->i_mount))
+                return -EIO;
+
+        xfs_ilock(ip, XFS_ILOCK_EXCL);
+        error = xfs_bmap_last_extent(NULL, ip, XFS_DATA_FORK, &got, &is_empty);
+        if (!error && !is_empty && got.br_startoff >= off &&
+            ((got.br_startoff + shift) & BMBT_STARTOFF_MASK) < got.br_startoff)
+                error = -EINVAL;
+        xfs_iunlock(ip, XFS_ILOCK_EXCL);
+
+        return error;
+}
+
 int
 xfs_bmap_insert_extents(
         struct xfs_trans        *tp,
diff --git a/fs/xfs/libxfs/xfs_bmap.h b/fs/xfs/libxfs/xfs_bmap.h
index 99dddbd0fcc6..9b49ddf99c41 100644
--- a/fs/xfs/libxfs/xfs_bmap.h
+++ b/fs/xfs/libxfs/xfs_bmap.h
@@ -227,6 +227,8 @@ int	xfs_bmap_collapse_extents(struct xfs_trans *tp, struct xfs_inode *ip,
                 xfs_fileoff_t *next_fsb, xfs_fileoff_t offset_shift_fsb,
                 bool *done, xfs_fsblock_t *firstblock,
                 struct xfs_defer_ops *dfops);
+int     xfs_bmap_can_insert_extents(struct xfs_inode *ip, xfs_fileoff_t off,
+                xfs_fileoff_t shift);
 int     xfs_bmap_insert_extents(struct xfs_trans *tp, struct xfs_inode *ip,
                 xfs_fileoff_t *next_fsb, xfs_fileoff_t offset_shift_fsb,
                 bool *done, xfs_fileoff_t stop_fsb, xfs_fsblock_t *firstblock,
diff --git a/fs/xfs/libxfs/xfs_format.h b/fs/xfs/libxfs/xfs_format.h
index 7b4a43deb83e..059bc44c27e8 100644
--- a/fs/xfs/libxfs/xfs_format.h
+++ b/fs/xfs/libxfs/xfs_format.h
@@ -1529,6 +1529,8 @@ typedef struct xfs_bmdr_block {
 #define BMBT_STARTBLOCK_BITLEN  52
 #define BMBT_BLOCKCOUNT_BITLEN  21
 
+#define BMBT_STARTOFF_MASK      ((1ULL << BMBT_STARTOFF_BITLEN) - 1)
+
 typedef struct xfs_bmbt_rec {
         __be64                  l0, l1;
 } xfs_bmbt_rec_t;
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index c195b9d857af..bb417156e3bf 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -1383,6 +1383,10 @@ xfs_insert_file_space(
 
         trace_xfs_insert_file_space(ip);
 
+        error = xfs_bmap_can_insert_extents(ip, stop_fsb, shift_fsb);
+        if (error)
+                return error;
+
         error = xfs_prepare_shift(ip, offset);
         if (error)
                 return error;