safepos = conf->reshape_safe;
        sector_div(safepos, data_disks);
        if (mddev->reshape_backwards) {
-               writepos -= min_t(sector_t, reshape_sectors, writepos);
+               BUG_ON(writepos < reshape_sectors);
+               writepos -= reshape_sectors;
                readpos += reshape_sectors;
                safepos += reshape_sectors;
        } else {
                writepos += reshape_sectors;
+               /* readpos and safepos are worst-case calculations.
+                * A negative number is overly pessimistic, and causes
+                * obvious problems for unsigned storage.  So clip to 0.
+                */
                readpos -= min_t(sector_t, reshape_sectors, readpos);
                safepos -= min_t(sector_t, reshape_sectors, safepos);
        }