Bug 600197

Description of problem:
The qemu-kvm process exit with a segmentation fault during the unattended installation of win2k3.

Version-Release number of selected component (if applicable):
qemu-kvm:
qemu-kvm-debuginfo-0.12.1.2-2.69.el6.x86_64
qemu-kvm-tools-0.12.1.2-2.69.el6.x86_64
qemu-kvm-0.12.1.2-2.69.el6.x86_64
kernel:
2.6.32-25.el6.x86_64

How reproducible:
Once

Steps to Reproduce:
1. Use autotest to do the unattended installation for win2k3 64bit
2. Wait for its completion
3.
  
Actual results:
qemu[7826]: segfault at ffffffdd022d3490 ip 00000000004dc29c sp 00007fff3ca5fed0 error 4 in qemu-kvm[400000+240000]

Expected results:
The installation should finished

Additional info:
1. bt from core file:
Core was generated by `/usr/local/staf/test/RHEV/kvm-new/autotest/client/tests/kvm/qemu -name vm1 -mon'.
Program terminated with signal 11, Segmentation fault.
#0  0x00000000004dc29c in tcp_output (tp=0x21d3300) at slirp/tcp_output.c:122
122				tp->t_rxtshift = 0;
Missing separate debuginfos, use: debuginfo-install alsa-lib-1.0.21-3.el6.x86_64 cairo-spice-1.8.7.1-4.el6.x86_64 celt051-0.5.1.3-0.el6.x86_64 cyrus-sasl-lib-2.1.23-8.el6.x86_64 cyrus-sasl-md5-2.1.23-8.el6.x86_64 cyrus-sasl-plain-2.1.23-8.el6.x86_64 db4-4.7.25-15.el6.x86_64 dbus-libs-1.2.24-1.el6.x86_64 expat-2.0.1-9.1.el6.x86_64 ffmpeg-spice-libs-0.4.9-0.15.5spice.20080908.el6.x86_64 fontconfig-2.8.0-1.el6.x86_64 freetype-2.3.11-3.el6.x86_64 glibc-2.12-1.3.el6.x86_64 gnutls-2.8.5-3.el6.x86_64 keyutils-libs-1.4-1.el6.x86_64 krb5-libs-1.8.1-4.el6.x86_64 libICE-1.0.6-1.el6.x86_64 libSM-1.1.0-7.1.el6.x86_64 libX11-1.3-1.el6.x86_64 libXau-1.0.5-1.el6.x86_64 libXdamage-1.1.2-1.el6.x86_64 libXext-1.1-2.el6.x86_64 libXfixes-4.0.4-1.el6.x86_64 libXi-1.3-2.el6.x86_64 libXtst-1.0.99.2-3.el6.x86_64 libXxf86vm-1.1.0-1.el6.x86_64 libaio-0.3.107-10.el6.x86_64 libasyncns-0.8-1.1.el6.x86_64 libcom_err-1.41.10-6.el6.x86_64 libdrm-2.4.20-2.el6.x86_64 libgcc-4.4.4-5.el6.x86_64 libgcrypt-1.4.5-3.el6.x86_64 libgpg-error-1.7-3.el6.x86_64 libpng-1.2.43-1.el6.x86_64 libselinux-2.0.90-3.el6.x86_64 libsndfile-1.0.20-3.el6.x86_64 libstdc++-4.4.4-2.el6.x86_64 libtasn1-2.3-3.el6.x86_64 libuuid-2.17.2-2.el6.x86_64 libxcb-1.5-1.el6.x86_64 mesa-libGL-7.7-2.el6.x86_64 mesa-libGLU-7.7-2.el6.x86_64 nss-softokn-freebl-3.12.4-17.el6.x86_64 openssl-1.0.0-1.el6.x86_64 pixman-spice-0.13.3-5.el6.x86_64 pulseaudio-libs-0.9.21-11.el6.x86_64 spice-server-0.4.2-10.el6.x86_64 tcp_wrappers-libs-7.6-56.3.el6.x86_64 zlib-1.2.3-24.el6.x86_64
(gdb) bt
#0  0x00000000004dc29c in tcp_output (tp=0x21d3300) at slirp/tcp_output.c:122
#1  0x00000000004ddbd2 in tcp_timers (slirp=0x2197180) at slirp/tcp_timer.c:242
#2  tcp_slowtimo (slirp=0x2197180) at slirp/tcp_timer.c:88
#3  0x00000000004d7638 in slirp_select_poll (readfds=0x7fff3ca60150, writefds=0x7fff3ca600d0, xfds=0x7fff3ca60050, select_error=0) at slirp/slirp.c:407
#4  0x000000000040b015 in main_loop_wait (timeout=1000) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4095
#5  0x000000000042805a in kvm_main_loop () at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:2127
#6  0x000000000040df1b in main_loop (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>)
    at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4284
#7  main (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:6414
(gdb) 


2. qemu-kvm cmdline: /usr/local/staf/test/RHEV/kvm-new/autotest/client/tests/kvm/qemu -name 'vm1' -monitor tcp:0:6001,server,nowait -drive file=/usr/local/staf/test/RHEV/kvm-new/autotest/client/tests/kvm/images/win2003-64.qcow2,if=ide,cache=none,boot=on -net nic,vlan=0,model=e1000,macaddr=02:FF:B4:2C:8a:e8 -net user,vlan=0 -m 4096 -smp 1 -drive file=/usr/local/staf/test/RHEV/kvm-new/autotest/client/tests/kvm/isos/ISO/Win2003/64/Windows2003-64.iso,index=2,media=cdrom -soundhw ac97 -fda /usr/local/staf/test/RHEV/kvm-new/autotest/client/tests/kvm/images/floppy.img -redir tcp:5000::22 -redir tcp:5001::12323 -vnc :0 -usbdevice tablet -rtc-td-hack -no-hpet -cpu qemu64,+sse2 -no-kvm-pit-reinjection -boot d -serial unix:/tmp/serial-20100604-135735-c2hU,server,nowait

3. cpuinfo:
processor	: 7
vendor_id	: GenuineIntel
cpu family	: 6
model		: 26
model name	: Intel(R) Core(TM) i7 CPU         920  @ 2.67GHz
stepping	: 4
cpu MHz		: 1600.000
cache size	: 8192 KB
physical id	: 0
siblings	: 8
core id		: 3
cpu cores	: 4
apicid		: 7
initial apicid	: 7
fpu		: yes
fpu_exception	: yes
cpuid level	: 11
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good xtopology nonstop_tsc aperfmperf pni dtes64 monitor ds_cpl vmx est tm2 ssse3 cx16 xtpr pdcm sse4_1 sse4_2 popcnt lahf_lm ida tpr_shadow vnmi flexpriority ept vpid
bogomips	: 5319.07
clflush size	: 64
cache_alignment	: 64
address sizes	: 36 bits physical, 48 bits virtual
power management: