Bug 1176553

Description of problem:
this bug is different from Bug 1176540 which only 9 and 10 pci-bridge hit it, but if more than 11 pci-bridge, qemu will Segmentation fault (core dumped) which has different bt log.

Version-Release number of selected component (if applicable):
host info:
3.10.0-217.el7.x86_64
qemu-kvm-rhev-2.1.2-17.el7.x86_64
seabios-1.7.5-6.el7.x86_64
guest info:
rhel6.6-z, 2.6.32-504.6.1.el6.x86_64

How reproducible:
100%

Steps to Reproduce:
1.assign all the device behind the more than eleventh pci-bridge.
2.
3.

Actual results:
after step 1, qemu will Segmentation fault (core dumped) 
QEMU 2.1.2 monitor - type 'help' for more information
(qemu) *** stack smashing detected ***: /usr/libexec/qemu-kvm terminated
Segmentation fault (core dumped)

(gdb) bt
#0  0x00007fd213055128 in ?? () from /lib64/libgcc_s.so.1
#1  0x00007fd213056029 in _Unwind_Backtrace () from /lib64/libgcc_s.so.1
#2  0x00007fd212d8ef86 in backtrace () from /lib64/libc.so.6
#3  0x00007fd212cfae44 in __libc_message () from /lib64/libc.so.6
#4  0x00007fd212d92937 in __fortify_fail () from /lib64/libc.so.6
#5  0x00007fd212d92900 in __stack_chk_fail () from /lib64/libc.so.6
#6  0x00007fd21a4ea805 in qdev_get_fw_dev_path (dev=<optimized out>) at hw/core/qdev.c:675
#7  0x3540697363732f31 in ?? ()
#8  0x00007fd21ae90000 in inode.24178 ()
#9  0x0000000000000000 in ?? ()
(gdb) bt full
#0  0x00007fd213055128 in ?? () from /lib64/libgcc_s.so.1
No symbol table info available.
#1  0x00007fd213056029 in _Unwind_Backtrace () from /lib64/libgcc_s.so.1
No symbol table info available.
#2  0x00007fd212d8ef86 in backtrace () from /lib64/libc.so.6
No symbol table info available.
#3  0x00007fd212cfae44 in __libc_message () from /lib64/libc.so.6
No symbol table info available.
#4  0x00007fd212d92937 in __fortify_fail () from /lib64/libc.so.6
No symbol table info available.
#5  0x00007fd212d92900 in __stack_chk_fail () from /lib64/libc.so.6
No symbol table info available.
#6  0x00007fd21a4ea805 in qdev_get_fw_dev_path (dev=<optimized out>) at hw/core/qdev.c:675
        path = "/pci@i0cf8/pci-bridge@3/pci-bridge@1/pci-bridge@1/pci-bridge@1/pci-bridge@1/pci-bridge@1/pci-bridge@1/pci-bridge@1/pci-bridge@1"
        l = <optimized out>
#7  0x3540697363732f31 in ?? ()
No symbol table info available.
#8  0x00007fd21ae90000 in inode.24178 ()
No symbol table info available.
#9  0x0000000000000000 in ?? ()
No symbol table info available.
(gdb) q

Expected results:

Additional info:
# /usr/libexec/qemu-kvm -machine type=pc,dump-guest-core=off -S -cpu SandyBridge -enable-kvm -m 4096 -smp 4,sockets=2,cores=2,threads=1 -no-kvm-pit-reinjection -usb -device usb-tablet,id=input0 -name sluo -uuid 990ea161-6b67-47b2-b803-19fb01d30d11 -rtc base=localtime,clock=host,driftfix=slew -device pci-bridge,bus=pci.0,id=bridge1,chassis_nr=1,addr=0x3 -device pci-bridge,bus=bridge1,id=bridge2,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge2,id=bridge3,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge3,id=bridge4,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge4,id=bridge5,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge5,id=bridge6,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge6,id=bridge7,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge7,id=bridge8,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge8,id=bridge9,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge9,id=bridge10,chassis_nr=1,addr=0x1 -device pci-bridge,bus=bridge10,id=bridge11,chassis_nr=1,addr=0x1 -device virtio-serial-pci,id=virtio-serial0,max_ports=16,vectors=0,bus=bridge11,addr=0x4 -chardev socket,id=channel1,path=/tmp/helloworld1,server,nowait -device virtserialport,chardev=channel1,name=com.redhat.rhevm.vdsm0,bus=virtio-serial0.0,id=port1 -chardev socket,id=channel2,path=/tmp/helloworld2,server,nowait -device virtserialport,chardev=channel2,name=com.redhat.rhevm.vdsm1,bus=virtio-serial0.0,id=port2 -drive file=/home/RHEL-Server-6.6.z-64-virtio-scsi.qcow2,if=none,id=drive-system-disk,format=qcow2,cache=none,aio=native,werror=stop,rerror=stop -device virtio-blk-pci,bus=bridge11,addr=0x5,drive=drive-system-disk,id=system-disk,bootindex=1 -netdev tap,id=hostnet0,vhost=on,queues=4,script=/etc/qemu-ifup -device virtio-net-pci,mq=on,vectors=17,netdev=hostnet0,id=virtio-net-pci0,mac=08:2e:5f:0a:0d:b1,bus=bridge11,addr=0x6,bootindex=2 -device virtio-balloon-pci,id=ballooning,bus=bridge11,addr=0x7 -global PIIX4_PM.disable_s3=0 -global PIIX4_PM.disable_s4=0 -k en-us -boot menu=on -qmp tcp:0:4444,server,nowait -serial unix:/tmp/ttyS0,server,nowait -vnc :1 -spice disable-ticketing,port=5931 -monitor stdio