Bug 542923

Description of problem:
Get segmentation fault

Version-Release number of selected component (if applicable):
kmod-kvm-83-136.el5
kernel: 2.6.18-175.el5

How reproducible:
100%

Steps to Reproduce:
1. use the installed image (install with kvm-83-105.el5_4.12) 
#qemu-img info win28k-64-virtio.qcow2
file format: qcow2
virtual size: 20G (21474836480 bytes)
disk size: 12G
cluster_size: 4096

2.on host (kvm-83-136.el5 kernel: 2.6.18-175.el5)
  start guest with the following command:
/usr/libexec/qemu-kvm -rtc-td-hack -usbdevice tablet -no-hpet -cpu qemu64,+sse2 -no-kvm-pit-reinjection -drive file=/root/win28k-64-virtio.qcow2 -smp 2 -m 2G -net nic,macaddr=00:21:02:4d:9b:2c,vlan=0 -net tap,script=/etc/qemu-ifup,vlan=0 -uuid `uuidgen` -vnc :1 -boot c -monitor stdio

  
Actual results:
segmentation fault

Expected results:
the guest could boot up, no segmentation fault

Additional info:

#gdb /usr/libexec/qemu-kvm
GNU gdb Fedora (6.8-37.el5)
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu"...
(gdb) r -rtc-td-hack -usbdevice tablet -no-hpet -cpu qemu64,+sse2 -no-kvm-pit-reinjection -drive file=/root/win28k-64-virtio.qcow2 -smp 2 -m 2G -net nic,macaddr=00:21:02:4d:9b:2c,vlan=0 -net tap,script=/etc/qemu-ifup,vlan=0 -uuid `uuidgen` -vnc :1 -boot c -monitor stdio
Starting program: /usr/libexec/qemu-kvm -rtc-td-hack -usbdevice tablet -no-hpet -cpu qemu64,+sse2 -no-kvm-pit-reinjection -drive file=/root/win28k-64-virtio.qcow2 -smp 2 -m 2G -net nic,macaddr=00:21:02:4d:9b:2c,vlan=0 -net tap,script=/etc/qemu-ifup,vlan=0 -uuid `uuidgen` -vnc :1 -boot c -monitor stdio
[Thread debugging using libthread_db enabled]
Detaching after fork from child process 3929.
[New Thread 0x2b74e2397f90 (LWP 3926)]
[New Thread 0x40a95940 (LWP 3935)]
[New Thread 0x416f2940 (LWP 3937)]
[New Thread 0x426e5940 (LWP 3938)]
[New Thread 0x430e6940 (LWP 3939)]
QEMU 0.9.1 monitor - type 'help' for more information
(qemu) [New Thread 0x43ae7940 (LWP 3940)]
[Thread 0x430e6940 (LWP 3939) exited]
[New Thread 0x430e6940 (LWP 3948)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x416f2940 (LWP 3937)]
qemu_bh_schedule (bh=0x5e0810)
    at /usr/src/debug/kvm-83-maint-snapshot-20090205/qemu/vl.c:3606
3606        if (bh->scheduled)
(gdb) bt
#0  qemu_bh_schedule (bh=0x5e0810)
    at /usr/src/debug/kvm-83-maint-snapshot-20090205/qemu/vl.c:3606
#1  0x00000000004616c8 in bdrv_aio_flush_em (bs=0x1fb5c5a0, 
    cb=<value optimized out>, opaque=<value optimized out>) at block.c:1552
#2  0x00000000004fddb8 in kvm_outb (opaque=<value optimized out>, addr=36032, 
    data=2 '\002')
    at /usr/src/debug/kvm-83-maint-snapshot-20090205/qemu/qemu-kvm.c:684
#3  0x00000000005292c8 in handle_io (kvm=0x1fb49780, run=0x2aaaaabfa000, 
    vcpu=0) at libkvm.c:735
#4  0x0000000000529bb2 in kvm_run (kvm=0x1fb49780, vcpu=0, env=0x1fbceb60)
    at libkvm.c:964
#5  0x00000000004fe4f9 in kvm_cpu_exec (env=0x2)
    at /usr/src/debug/kvm-83-maint-snapshot-20090205/qemu/qemu-kvm.c:206
#6  0x00000000004fe783 in ap_main_loop (_env=<value optimized out>)
    at /usr/src/debug/kvm-83-maint-snapshot-20090205/qemu/qemu-kvm.c:402
#7  0x00000035c56064a7 in start_thread () from /lib64/libpthread.so.0
#8  0x00000035c4ad3c2d in clone () from /lib64/libc.so.6