diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -2864,6 +2864,14 @@ static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl)
 	if (newval >= tp->dmt_budmin) {
 		/* pickup a pointer to the leaves of the tree.
 		 */
+
+		/* Validate newval to prevent shift-out-of-bounds in
+		 * BUDSIZE.  The maximum meaningful value is budmin +
+		 * l2nleafs; anything beyond indicates corrupted metadata.
+		 */
+		if (newval > tp->dmt_budmin +
+		    le32_to_cpu(tp->dmt_l2nleafs))
+			return -EIO;
 		leaf = tp->dmt_stree + le32_to_cpu(tp->dmt_leafidx);

 		/* try to join the specified leaf into a large binary