xfs: fix allocation length overflow in xfs_bmapi_write()