Bug 1184325

Description of problem:
Snapshot chain: SN B -> SN A -> base image
QEMU aborted after booting from snapshot B.

Version-Release number of selected component (if applicable):
qemu-system-ppc-2.0.0-2.1.pkvm2_1_1.20.40.ppc64

How reproducible:
1/10

Steps to Reproduce:
1. Launch a VM, copy a file from host to guest, and then shutdown the guest.
# /bin/qemu-kvm ... \
    -device spapr-vscsi,id=spapr_vscsi0 \
    -drive id=drive_image1,if=none,cache=none,snapshot=off,aio=native,file=/home/xuhan/autotest/client/tests/virt/shared/data/images/rhel71-ppc64-spapr_vscsi.qcow2 \
    -device scsi-hd,id=image1,drive=drive_image1

(host)# dd if=/dev/urandom of=/tmp/test.img bs=4k count=250
(host)# scp -v -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o PreferredAuthentications=password -r  -P 22 /tmp/test.img root@$GUEST_IP_ADDR:/tmp/test.img

2. Create snapshot A for base image, and repeat step 1.
# /bin/qemu-img create -f qcow2 -b /home/xuhan/autotest/client/tests/virt/shared/data/images/rhel71-ppc64-spapr_vscsi.qcow2 -F qcow2 /home/xuhan/autotest/client/tests/virt/shared/data/images/snA.qcow2 20G

3. Create snapshot B for snapshot A, and repeat step 1.
# /bin/qemu-img create -f qcow2 -b /home/xuhan/autotest/client/tests/virt/shared/data/images/snA.qcow2 -F qcow2 /home/xuhan/autotest/client/tests/virt/shared/data/images/snB.qcow2 20G


Actual results:
After booting from snapshot B, QEMU aborted:
*** Error in `/usr/bin/qemu-system-ppc64': free(): invalid pointer: 0x00003fffa00afdd0 ***
...
/tmp/aexpect/Bamw4MGY/aexpect-2lz1LQ.sh: line 1: 63106 Aborted                 (core dumped) ...


Expected results:
No crash.


Additional info:
QEMU command line:
/bin/qemu-kvm \
    -S  \
    -name 'virt-tests-vm1'  \
    -sandbox off  \
    -machine pseries,accel=kvm  \
    -nodefaults  \
    -device VGA,id=video0  \
    -chardev socket,id=qmp_id_qmpmonitor1,path=/tmp/monitor-qmpmonitor1-20150117-152008-8Js3ZmgJ,server,nowait \
    -mon chardev=qmp_id_qmpmonitor1,mode=control  \
    -serial unix:'/tmp/serial-serial0-20150117-152008-8Js3ZmgJ',server,nowait \
    -device pci-ohci,id=usb1,bus=pci.0,addr=03 \
    -device spapr-vscsi,id=spapr_vscsi0 \
    -drive id=drive_image1,if=none,cache=none,snapshot=off,aio=native,file=/home/xuhan/autotest/client/tests/virt/shared/data/images/rhel71-ppc64-spapr_vscsi.qcow2 \
    -device scsi-hd,id=image1,drive=drive_image1 \
    -device spapr-vlan,mac=9a:ca:cb:cc:cd:ce,id=idHkSasf,netdev=ideWRoyw  \
    -netdev tap,id=ideWRoyw,fd=22  \
    -m 8192  \
    -smp 4,maxcpus=4,cores=2,threads=1,sockets=2  \
    -cpu 'POWER8' \
    -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1  \
    -device usb-kbd,id=input0 \
    -device usb-mouse,id=input1  \
    -vnc :1  \
    -rtc base=utc,clock=host,driftfix=slew  \
    -boot order=cdn,once=c,menu=off

Backtrace:
#0  0x00003fffb146d7d0 in __GI_raise (sig=<optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00003fffb146f7c4 in __GI_abort () at abort.c:90
#2  0x00003fffb14b3634 in __libc_message (do_abort=<optimized out>, fmt=0x3fffb15a93c0 "*** Error in `%s': %s: 0x%s ***\n")
    at ../sysdeps/unix/sysv/linux/libc_fatal.c:196
#3  0x00003fffb14beab4 in malloc_printerr (ptr=<optimized out>, str=0x3fffb15a9448 "free(): invalid pointer", action=3) at malloc.c:4937
#4  _int_free (av=0x3fffb15f04e0 <main_arena>, p=<optimized out>, have_lock=<optimized out>) at malloc.c:3789
#5  0x000000003bd0b0f4 in free_and_trace (mem=<optimized out>) at vl.c:2878
#6  0x00003fffb2781dc8 in g_free (mem=<optimized out>) at gmem.c:252
#7  0x00003fffb27a1394 in g_slice_free1 (mem_size=0, mem_block=0x3fffa00afdd0) at gslice.c:1111
#8  0x000000003bb2c91c in qemu_aio_release (p=<optimized out>) at block.c:4676
#9  0x000000003bb3c44c in qemu_laio_process_completion (s=0x1000162df90, laiocb=0x3fffa00afdd0) at block/linux-aio.c:74
#10 qemu_laio_completion_cb (e=0x1000162df98) at block/linux-aio.c:96
#11 0x000000003bb1085c in aio_dispatch (ctx=ctx@entry=0x10001498230) at aio-posix.c:144
#12 0x000000003bb10c88 in aio_poll (ctx=0x10001498230, blocking=false) at aio-posix.c:193
#13 0x000000003bb110b8 in aio_ctx_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at async.c:205
#14 0x00003fffb2779b40 in g_main_dispatch (context=0x1000149ffc0) at gmain.c:3054
#15 g_main_context_dispatch (context=0x1000149ffc0) at gmain.c:3630
#16 0x000000003bc751bc in glib_pollfds_poll () at main-loop.c:190
#17 os_host_main_loop_wait (timeout=<optimized out>) at main-loop.c:235
#18 main_loop_wait (nonblocking=<optimized out>) at main-loop.c:484
#19 0x000000003bb06120 in main_loop () at vl.c:2070
#20 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4535