It should be possible to do much better checking of the block being read from the journal during recovery. This would ensure that we do not write bad data over good data in the case that there is corruption of the journal blocks during recovery.

Lots of blocks have pointers in them (some inodes, indirect blocks, directory leaf blocks, etc) and we can verify that these point to valid blocks by checking the resource group data (i.e. ensure that the block number is higher than the super block, is less than the end of the filesystem and also does not refer to one of the rgrp blocks). We will need to ensure that the block to rgrp mapping is more efficient first though.

There are a number of other things which could be checked, particularly in the case of inode where we can check that the inode is of a valid type, and that the flags make sense for that type, etc.

Since recovery is an occasional activity it would be reasonable to do more tests that we can ordinarily do during normal fs operation (due to performance concerns).