Bug 1209813

description of problem:
libvirtd crashes after memory device hot-unplug crashes qemu

Version-Release number of selected component (if applicable):
libvirt-1.2.14-1.el7.x86_64
qemu-kvm-rhev-2.2.0-8.el7.x86_64

How reproducible:
60%(cannot reproduce it every time, this issue just like bug
https://bugzilla.redhat.com/show_bug.cgi?id=1161024)

Steps to Reproduce:
1.prepare a dom have maxmemory setttings (prepare for memdevice)
# virsh dumpxml test3

  <maxMemory slots='16' unit='KiB'>1524288</maxMemory>
  <memory unit='KiB'>1024000</memory>
  <currentMemory unit='KiB'>1024000</currentMemory>
  <vcpu placement='static' cpuset='0-1' current='2'>4</vcpu>
...
  <cpu>
    <numa>
      <cell id='0' cpus='0-1' memory='512000' unit='KiB'/>
      <cell id='1' cpus='2-3' memory='512000' unit='KiB'/>
    </numa>
  </cpu>
...


2. start it

# virsh start test3
Domain test3 started

3.hotplug memdevice

# cat memdevice.xml
    <memory model='dimm'>
      <target>
        <size unit='KiB'>500000</size>
        <node>1</node>
      </target>
    </memory>

# virsh attach-device test3 memdevice.xml
error: Failed to attach device from memdevice.xml
error: End of file while reading data: Input/output error



Actual results:
libvirtd crashes after memory device hot-unplug crashes qemu

Expected results:
fix it

infomation:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f6aa252d700 (LWP 15528)]
qemuMonitorDelObject (mon=0x0, objalias=0x7f6a8c000b00 "memdimm0") at qemu/qemu_monitor.c:3268
3268            if (mon->json)
(gdb) bt
#0  qemuMonitorDelObject (mon=0x0, objalias=0x7f6a8c000b00 "memdimm0") at qemu/qemu_monitor.c:3268
#1  0x00007f6a99af3ecc in qemuDomainAttachMemory (driver=driver@entry=0x7f6a90184a70, vm=vm@entry=0x7f6a901e6470, mem=0x7f6a8c000c00) at qemu/qemu_hotplug.c:1735
#2  0x00007f6a99b5eca9 in qemuDomainAttachDeviceLive (dom=<optimized out>, dev=0x7f6a8c000b80, vm=0x7f6a901e6470) at qemu/qemu_driver.c:7672
#3  qemuDomainAttachDeviceFlags (dom=<optimized out>, xml=<optimized out>, flags=<optimized out>) at qemu/qemu_driver.c:8379
#4  0x00007f6ab21a9386 in virDomainAttachDevice (domain=domain@entry=0x7f6a8c001560,
    xml=0x7f6a8c001370 "    <memory model='dimm'>\n      <target>\n        <size unit='KiB'>500000</size>\n        <node>1</node>\n      </target>\n    </memory>\n") at libvirt-domain.c:8334
#5  0x00007f6ab2c55e9f in remoteDispatchDomainAttachDevice (server=0x7f6ab48d3ef0, msg=0x7f6ab48ec460, args=0x7f6a8c000c70, rerr=0x7f6aa252cc70, client=<optimized out>) at remote_dispatch.h:2732
#6  remoteDispatchDomainAttachDeviceHelper (server=0x7f6ab48d3ef0, client=<optimized out>, msg=0x7f6ab48ec460, rerr=0x7f6aa252cc70, args=0x7f6a8c000c70, ret=0x7f6a8c000920) at remote_dispatch.h:2708
#7  0x00007f6ab220b152 in virNetServerProgramDispatchCall (msg=0x7f6ab48ec460, client=0x7f6ab48ed290, server=0x7f6ab48d3ef0, prog=0x7f6ab48e8920) at rpc/virnetserverprogram.c:437
#8  virNetServerProgramDispatch (prog=0x7f6ab48e8920, server=server@entry=0x7f6ab48d3ef0, client=0x7f6ab48ed290, msg=0x7f6ab48ec460) at rpc/virnetserverprogram.c:307
#9  0x00007f6ab2c63efd in virNetServerProcessMsg (msg=<optimized out>, prog=<optimized out>, client=<optimized out>, srv=0x7f6ab48d3ef0) at rpc/virnetserver.c:172
#10 virNetServerHandleJob (jobOpaque=<optimized out>, opaque=0x7f6ab48d3ef0) at rpc/virnetserver.c:193
#11 0x00007f6ab2107615 in virThreadPoolWorker (opaque=opaque@entry=0x7f6ab48cee70) at util/virthreadpool.c:145
#12 0x00007f6ab2106b38 in virThreadHelper (data=<optimized out>) at util/virthread.c:206
#13 0x00007f6aaf53fdf5 in start_thread (arg=0x7f6aa252d700) at pthread_create.c:308
#14 0x00007f6aaf2661ad in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:113
Additional info: