jbd2: fix r_count overflows leading to buffer overflow in journal recovery