Description of problem:
Boot up a guest with a data disk, add an existed disk image with 'blockdev-add', do 'blockdev-snapshot' to the data disk, then do 'blockdev-mirror' to the same source/target disk, guest 'Segmentation fault  (core dumped)'.

Version-Release number of selected component (if applicable):
Host kernel: 3.10.0-888.el7.x86_64
Qemu-kvm-rhev: qemu-kvm-rhev-2.12.0-2.el7.x86_64
Guest kernel: 3.10.0-889.el7.x86_64

How reproducible:
100%

Steps to Reproduce:
1. Boot up a guest with a data disk 'drive_image2':

-drive id=drive_image2,if=none,snapshot=off,aio=threads,cache=none,format=qcow2,file=/home/hd1 \
-device scsi-hd,id=image2,drive=drive_image2 \

2. Create a disk image with the same size of above disk:
# qemu-img create -f qcow2 hd1.qcow2 2G

3. Add the created disk as 'drive2' with 'blockdev-add':

# nc -U /var/tmp/avocado1
{"QMP": {"version": {"qemu": {"micro": 0, "minor": 12, "major": 2}, "package": "qemu-kvm-rhev-2.12.0-2.el7"}, "capabilities": []}}
{"execute":"qmp_capabilities"}
{"return": {}}
{"execute":"blockdev-add","arguments":{"driver":"qcow2","node-name":"drive2","file":{"driver":"file","filename":"/home/hd1.qcow2"}}
}
{"return": {}}

4. Create snapshot for above 'drive_image2' on the new disk 'drive2':

{ "execute": "blockdev-snapshot", "arguments": { "node":"drive_image2","overlay":"drive2"}}
{"return": {}}

5. To do error handle test, continue to create a mirror for the 'drive_image2' on the same target disk 'drive2':

{ "execute": "blockdev-mirror","arguments":{"device":"drive_image2","target":"drive2","sync":"full"}}
Ncat: Connection reset by peer.


Actual results:
Segmentation fault  (core dumped) to the guest.

Expected results:
Error prompt as follows in qmp:
{"error": {"class": "GenericError", "desc": "The snapshot is already in use"}}
or
{"error": {"class": "GenericError", "desc": "Failed to get \"write\" lock"}}


Additional info:
1. If create mirror first then create a snapshot on the same target, there is following error prompt without other issues:
......
{ "execute": "block-job-complete","arguments":{"device":"drive_image2"}}
{"return": {}}
{"timestamp": {"seconds": 1527132274, "microseconds": 118837}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "drive_image2", "len": 0, "offset": 0, "speed": 0, "type": "mirror"}}
{ "execute": "blockdev-snapshot", "arguments": { "node":"drive_image2","overlay":"drive2"}}
{"error": {"class": "GenericError", "desc": "The snapshot is already in use"}}

2. If do similar test using 'blockdev-snapshot-sync' and 'drive-mirror' instead, the error prompt is as follows without any other issue:

{ "execute": "blockdev-snapshot-sync", "arguments": { "device": "drive_image2","snapshot-file":"sn1","format":"qcow2","mode":"absolute-paths"}} 
{"return": {}}
 { "execute": "drive-mirror", "arguments": { "device": "drive_image2","target": "sn1", "format": "qcow2", "mode": "absolute-paths", "sync": "full"}}
{"error": {"class": "GenericError", "desc": "Failed to get \"write\" lock"}}