Andrey Savochkin from SWsoft Virtuozzo/OpenVZ Linux Team has found the cause of
 block bitmap leakage on ext3 filesystem.

[vvs@dhcp17-60 ~]$ uname -a
Linux dhcp17-60.qa.sw.ru 2.6.9-42.0.8.EL #1 Tue Jan 23 12:34:49 EST 2007 x86_64
x86_64 x86_64 GNU/Linux
[vvs@dhcp17-60 ~]$ id
uid=500(vvs) gid=500(vvs) groups=500(vvs) context=user_u:system_r:unconfined_t

VVS comment: root permissions are required for the filesystem creation and
mount, issue can be triggered by any user, please see below.

[vvs@dhcp17-60 ~]$ su
Password:
[root@dhcp17-60 vvs]# dd if=/dev/zero of=/tmp/disk bs=1k count=10k
10240+0 records in
10240+0 records out
[root@dhcp17-60 vvs]# /sbin/mkfs.ext3 -Fq /tmp/disk
[root@dhcp17-60 vvs]# mount -o loop /tmp/disk /tmp/disk_mnt/
mount: mount point /tmp/disk_mnt/ does not exist
[root@dhcp17-60 vvs]# mkdir /tmp/disk_mnt
[root@dhcp17-60 vvs]# mount -o loop /tmp/disk /tmp/disk_mnt/
[root@dhcp17-60 vvs]# chmod 777 /tmp/disk_mnt/
[root@dhcp17-60 vvs]# exit
[vvs@dhcp17-60 ~]$ dd if=/dev/zero of=/tmp/disk_mnt/asdf.small bs=1 count=1
1+0 records in
1+0 records out
[vvs@dhcp17-60 ~]$ dd if=/dev/zero of=/tmp/disk_mnt/asdf.large bs=1k count=100k
dd: writing `/tmp/disk_mnt/asdf.large': No space left on device
8242+0 records in
8241+0 records out
[vvs@dhcp17-60 ~]$ sync
[vvs@dhcp17-60 ~]$ rm -rf /tmp/disk_mnt/asdf.small
[vvs@dhcp17-60 ~]$ sync
[vvs@dhcp17-60 ~]$ dd if=/dev/zero of=/tmp/disk_mnt/asdf.new seek=1000k bs=1k
count=1
dd: writing `/tmp/disk_mnt/asdf.new': No space left on device
1+0 records in
0+0 records out

VVS comment: filesystem is corrupted now, however Filesystem state is still clean.

[vvs@dhcp17-60 ~]$ su
Password:
[root@dhcp17-60 vvs]# umount /tmp/disk_mnt/
[root@dhcp17-60 vvs]# /sbin/dumpe2fs -fh /tmp/disk
dumpe2fs 1.35 (28-Feb-2004)
Filesystem volume name:   <none>
Last mounted on:          <not available>
Filesystem UUID:          0fec1da5-edea-4fe8-a7e3-20ccd0f36e61
Filesystem magic number:  0xEF53
Filesystem revision #:    1 (dynamic)
Filesystem features:      has_journal ext_attr resize_inode filetype sparse_super
Default mount options:    (none)
Filesystem state:         clean
Errors behavior:          Continue
Filesystem OS type:       Linux
Inode count:              2560
Block count:              10240
Reserved block count:     512
Free blocks:              512
Free inodes:              2547
First block:              1
Block size:               1024
Fragment size:            1024
Reserved GDT blocks:      39
Blocks per group:         8192
Fragments per group:      8192
Inodes per group:         1280
Inode blocks per group:   160
Filesystem created:       Tue Feb 13 10:19:22 2007
Last mount time:          Tue Feb 13 10:20:08 2007
Last write time:          Tue Feb 13 10:22:17 2007
Mount count:              1
Maximum mount count:      35
Last checked:             Tue Feb 13 10:19:22 2007
Check interval:           15552000 (6 months)
Next check after:         Sun Aug 12 11:19:22 2007
Reserved blocks uid:      0 (user root)
Reserved blocks gid:      0 (group root)
First inode:              11
Inode size:               128
Journal inode:            8
Default directory hash:   tea
Directory Hash Seed:      f3eaff28-85b0-440a-81a8-35e6e914583e
Journal backup:           inode blocks

[root@dhcp17-60 vvs]# /sbin/fsck -f -n /tmp/disk
fsck 1.35 (28-Feb-2004)
e2fsck 1.35 (28-Feb-2004)
Pass 1: Checking inodes, blocks, and sizes
Inode 12, i_blocks is 4, should be 2.  Fix? no

Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information
Block bitmap differences:  -8396
Fix? no


/tmp/disk: ********** WARNING: Filesystem still has errors **********

/tmp/disk: 13/2560 files (7.7% non-contiguous), 9728/10240 blocks