Description of problem:
  Qemu core dump when do backup with sync: bitmap and no bitmap provided

Version-Release number of selected component (if applicable):
  kernel version:4.18.0-160.el8.x86_64
  qemu-kvm version:qemu-kvm-4.2.0-4.module+el8.2.0+5220+e82621dc.x86_64

How reproducible:
 100%

Steps to Reproduce:
1.Start guest with qemu cmds:
    /usr/libexec/qemu-kvm \
    -name 'avocado-vt-vm1'  \
    -sandbox on  \
    -machine q35  \
    -nodefaults \
    -device VGA,bus=pcie.0,addr=0x1 \
    -m 7168  \
    -smp 4,maxcpus=4,cores=2,threads=1,dies=1,sockets=2  \
    -cpu 'Skylake-Client',+kvm_pv_unhalt  \
    -chardev socket,id=qmp_id_qmpmonitor1,path=/var/tmp/monitor-qmpmonitor1-20191211-004744-QuD8XYDI,server,nowait \
    -mon chardev=qmp_id_qmpmonitor1,mode=control  \
    -chardev socket,id=qmp_id_catch_monitor,path=/var/tmp/monitor-catch_monitor-20191211-004744-QuD8XYDI,server,nowait \
    -mon chardev=qmp_id_catch_monitor,mode=control \
    -device pvpanic,ioport=0x505,id=id8jnCka \
    -chardev socket,path=/var/tmp/serial-serial0-20191211-004744-QuD8XYDI,id=chardev_serial0,server,nowait \
    -device isa-serial,id=serial0,chardev=chardev_serial0  \
    -chardev socket,id=seabioslog_id_20191211-004744-QuD8XYDI,path=/var/tmp/seabios-20191211-004744-QuD8XYDI,server,nowait \
    -device isa-debugcon,chardev=seabioslog_id_20191211-004744-QuD8XYDI,iobase=0x402 \
    -device pcie-root-port,id=pcie.0-root-port-2,slot=2,chassis=2,addr=0x2,bus=pcie.0,multifunction=on \
    -device qemu-xhci,id=usb1,bus=pcie.0-root-port-2,addr=0x0 \
    -object iothread,id=iothread0 \
    -object iothread,id=iothread1 \
    -device pcie-root-port,id=pcie.0-root-port-3,slot=3,chassis=3,addr=0x2.0x1 \
    -device virtio-scsi-pci,id=virtio_scsi_pci0,iothread=iothread0,bus=pcie.0-root-port-3,addr=0x0 \
    -blockdev node-name=file_image1,driver=file,aio=threads,filename=/home/kvm_autotest_root/images/rhel820-64-virtio-scsi.qcow2,cache.direct=on,cache.no-flush=off \
    -blockdev node-name=drive_image1,driver=qcow2,cache.direct=on,cache.no-flush=off,file=file_image1 \
    -device scsi-hd,id=image1,drive=drive_image1,write-cache=on \
    -device pcie-root-port,id=pcie.0-root-port-4,slot=4,chassis=4,addr=0x2.0x2 \
    -blockdev node-name=file_data,driver=file,aio=threads,filename=/home/data.qcow2,cache.direct=on,cache.no-flush=off \
    -blockdev node-name=drive_data1,driver=qcow2,cache.direct=on,cache.no-flush=off,file=file_data \
    -device virtio-blk-pci,id=data1,drive=drive_data1,write-cache=on,bus=pcie.0-root-port-4 \
    -device pcie-root-port,id=pcie.0-root-port-5,slot=5,chassis=5,addr=0x2.0x3 \
    -device virtio-net-pci,mac=9a:a9:8f:6a:a0:36,id=idoelrY9,netdev=idTgrin0,bus=pcie.0-root-port-5,addr=0x0  \
    -netdev tap,id=idTgrin0,vhost=on \
    -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1  \
    -vnc :0  \
    -rtc base=utc,clock=host,driftfix=slew  \
    -boot menu=off,order=cdn,once=c,strict=off \
    -enable-kvm \
    -device pcie-root-port,id=pcie_extra_root_port_0,slot=6,chassis=6,addr=0x2.0x4 \
    -monitor stdio \
    -qmp tcp:0:3000,server,nowait \

2. Add a bitmap to data disk
    { "execute": "block-dirty-bitmap-add", "arguments": {"node": "drive_data1", "name": "bitmap0"}}

3. Check bitmap info:
    {"execute":"query-block"}
{"return": [{"io-status": "ok", "device": "", "locked": false, "removable": false, "inserted": {"iops_rd": 0, "detect_zeroes": "off", "image": {"virtual-size": 21474836480, "filename": "/home/kvm_autotest_root/images/rhel820-64-virtio-scsi.qcow2", "cluster-size": 65536, "format": "qcow2", "actual-size": 7109091328, "format-specific": {"type": "qcow2", "data": {"compat": "1.1", "lazy-refcounts": false, "refcount-bits": 16, "corrupt": false}}, "dirty-flag": false}, "iops_wr": 0, "ro": false, "node-name": "drive_image1", "backing_file_depth": 0, "drv": "qcow2", "iops": 0, "bps_wr": 0, "write_threshold": 0, "encrypted": false, "bps": 0, "bps_rd": 0, "cache": {"no-flush": false, "direct": true, "writeback": true}, "file": "/home/kvm_autotest_root/images/rhel820-64-virtio-scsi.qcow2", "encryption_key_missing": false}, "qdev": "image1", "type": "unknown"}, {"io-status": "ok", "device": "", "locked": false, "removable": false, "inserted": {"iops_rd": 0, "detect_zeroes": "off", "image": {"virtual-size": 2147483648, "filename": "/home/data.qcow2", "cluster-size": 65536, "format": "qcow2", "actual-size": 200704, "format-specific": {"type": "qcow2", "data": {"compat": "1.1", "lazy-refcounts": false, "refcount-bits": 16, "corrupt": false}}, "dirty-flag": false}, "iops_wr": 0, "ro": false, "node-name": "drive_data1", "backing_file_depth": 0, "drv": "qcow2", "iops": 0, "bps_wr": 0, "write_threshold": 0, "dirty-bitmaps": [{"name": "bitmap0", "recording": true, "persistent": false, "busy": false, "status": "active", "granularity": 65536, "count": 0}], "encrypted": false, "bps": 0, "bps_rd": 0, "cache": {"no-flush": false, "direct": true, "writeback": true}, "file": "/home/data.qcow2", "encryption_key_missing": false}, "qdev": "/machine/peripheral/data1/virtio-backend", "dirty-bitmaps": [{"name": "bitmap0", "recording": true, "persistent": false, "busy": false, "status": "active", "granularity": 65536, "count": 0}], "type": "unknown"}]}


4. In guest, dd file on data disk
   (guest)#dd if=/dev/urandom of=test bs=1M count=300

5. Check bitmap info
    {"execute":"query-block"}
{"return": [{"io-status": "ok", "device": "", "locked": false, "removable": false, "inserted": {"iops_rd": 0, "detect_zeroes": "off", "image": {"virtual-size": 21474836480, "filename": "/home/kvm_autotest_root/images/rhel820-64-virtio-scsi.qcow2", "cluster-size": 65536, "format": "qcow2", "actual-size": 7109091328, "format-specific": {"type": "qcow2", "data": {"compat": "1.1", "lazy-refcounts": false, "refcount-bits": 16, "corrupt": false}}, "dirty-flag": false}, "iops_wr": 0, "ro": false, "node-name": "drive_image1", "backing_file_depth": 0, "drv": "qcow2", "iops": 0, "bps_wr": 0, "write_threshold": 0, "encrypted": false, "bps": 0, "bps_rd": 0, "cache": {"no-flush": false, "direct": true, "writeback": true}, "file": "/home/kvm_autotest_root/images/rhel820-64-virtio-scsi.qcow2", "encryption_key_missing": false}, "qdev": "image1", "type": "unknown"}, {"io-status": "ok", "device": "", "locked": false, "removable": false, "inserted": {"iops_rd": 0, "detect_zeroes": "off", "image": {"virtual-size": 2147483648, "filename": "/home/data.qcow2", "cluster-size": 65536, "format": "qcow2", "actual-size": 123805696, "format-specific": {"type": "qcow2", "data": {"compat": "1.1", "lazy-refcounts": false, "refcount-bits": 16, "corrupt": false}}, "dirty-flag": false}, "iops_wr": 0, "ro": false, "node-name": "drive_data1", "backing_file_depth": 0, "drv": "qcow2", "iops": 0, "bps_wr": 0, "write_threshold": 0, "dirty-bitmaps": [{"name": "bitmap0", "recording": true, "persistent": false, "busy": false, "status": "active", "granularity": 65536, "count": 156827648}], "encrypted": false, "bps": 0, "bps_rd": 0, "cache": {"no-flush": false, "direct": true, "writeback": true}, "file": "/home/data.qcow2", "encryption_key_missing": false}, "qdev": "/machine/peripheral/data1/virtio-backend", "dirty-bitmaps": [{"name": "bitmap0", "recording": true, "persistent": false, "busy": false, "status": "active", "granularity": 65536, "count": 156827648}], "type": "unknown"}]}

6. Create target backup image sn1
   {'execute':'blockdev-create','arguments':{'options': {'driver':'file','filename':'/root/sn$i','size':2147483648},'job-id':'job1'}}
   {'execute':'blockdev-add','arguments':{'driver':'file','node-name':'drive_sn$i','filename':'/root/sn$i'}}
   {'execute':'blockdev-create','arguments':{'options': {'cluster-size':16384,'driver': 'qcow2','file':'drive_sn$i','size':2147483648},'job-id':'job2'}}
   {'execute':'blockdev-add','arguments':{'driver':'qcow2','node-name':'sn$i','file':'drive_sn$i'}}

7. Do backup with sync mode: bitmap
   { "execute": "blockdev-backup", "arguments": { "device": "drive_data1", "sync":"bitmap","target":"sn1","job-id":"j1"}}
Ncat: Connection reset by peer.


Actual results:
After step7, qemu core dump with info:
    qemu: qemu_mutex_unlock_impl: Operation not permitted
test.txt: line 43: 14436 Aborted                 (core dumped) /usr/libexec/qemu-kvm -name 'avocado-vt-vm1' -sandbox on -machine q35 -nodefaults -device VGA,bus=pcie.0,addr=0x1 ...

 gdb info:
   #0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50	  return ret;
[Current thread is 1 (Thread 0x7f7f5b45ef00 (LWP 14436))]
Missing separate debuginfos, use: yum debuginfo-install virglrenderer-0.6.0-5.20180814git491d3b705.module+el8.2.0+4793+b09dd2fb.x86_64
(gdb) bt
#0  0x00007f7f5605170f in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007f7f5603bb25 in __GI_abort () at abort.c:79
#2  0x0000561fd43a50ee in error_exit
    (err=<optimized out>, msg=msg@entry=0x561fd454a8d0 <__func__.16350> "qemu_mutex_unlock_impl")
    at util/qemu-thread-posix.c:36
#3  0x0000561fd43a53da in qemu_mutex_unlock_impl
    (mutex=mutex@entry=0x561fd6c77740, file=file@entry=0x561fd4549c7f "util/async.c", line=line@entry=526)
    at util/qemu-thread-posix.c:108
#4  0x0000561fd43a0349 in aio_context_release (ctx=ctx@entry=0x561fd6c776e0) at util/async.c:526
#5  0x0000561fd42d7d03 in bdrv_set_aio_context_ignore
    (bs=0x561fd6dd7c00, new_context=new_context@entry=0x561fd6c70330, ignore=ignore@entry=0x7ffd06825c60) at block.c:6018
#6  0x0000561fd42d7d5c in bdrv_set_aio_context_ignore
    (bs=bs@entry=0x561fd6ddfba0, new_context=new_context@entry=0x561fd6c70330, ignore=ignore@entry=0x7ffd06825c60)
    at block.c:5991
#7  0x0000561fd42d80d3 in bdrv_child_try_set_aio_context
    (bs=bs@entry=0x561fd6ddfba0, ctx=ctx@entry=0x561fd6c70330, ignore_child=ignore_child@entry=0x0, errp=errp@entry=0x7ffd06825d38) at block.c:6104
#8  0x0000561fd42d96ee in bdrv_try_set_aio_context
    (bs=bs@entry=0x561fd6ddfba0, ctx=ctx@entry=0x561fd6c70330, errp=errp@entry=0x7ffd06825d38) at block.c:6113
#9  0x0000561fd4175f0e in do_backup_common
    (backup=backup@entry=0x7ffd06825d40, bs=bs@entry=0x561fd6cb17b0, target_bs=target_bs@entry=0x561fd6ddfba0, aio_context=aio_context@entry=0x561fd6c70330, txn=txn@entry=0x0, errp=errp@entry=0x7ffd06825d38) at blockdev.c:3506
#10 0x0000561fd41766ac in do_blockdev_backup (backup=0x7ffd06825d40, txn=txn@entry=0x0, errp=0x7ffd06825d38)
    at /usr/src/debug/qemu-kvm-4.2.0-4.module+el8.2.0+5220+e82621dc.x86_64/./qapi/qapi-types-block-core.h:1492
#11 0x0000561fd417c192 in qmp_blockdev_backup (arg=<optimized out>, errp=<optimized out>) at blockdev.c:3751
#12 0x0000561fd4294431 in qmp_marshal_blockdev_backup (args=<optimized out>, ret=<optimized out>, errp=0x7ffd06825df8)
    at qapi/qapi-commands-block-core.c:471
#13 0x0000561fd435818c in do_qmp_dispatch
    (errp=0x7ffd06825df0, allow_oob=<optimized out>, request=<optimized out>, cmds=0x561fd4c43d80 <qmp_commands>)
    at qapi/qmp-dispatch.c:132
#14 0x0000561fd435818c in qmp_dispatch
    (cmds=0x561fd4c43d80 <qmp_commands>, request=<optimized out>, allow_oob=<optimized out>) at qapi/qmp-dispatch.c:175
--Type <RET> for more, q to quit, c to continue without paging--
#15 0x0000561fd4276391 in monitor_qmp_dispatch (mon=0x561fd6ce4be0, req=<optimized out>) at monitor/qmp.c:145
#16 0x0000561fd4276a2a in monitor_qmp_bh_dispatcher (data=<optimized out>) at monitor/qmp.c:234
#17 0x0000561fd439fb86 in aio_bh_call (bh=0x561fd6be2ce0) at util/async.c:117
#18 0x0000561fd439fb86 in aio_bh_poll (ctx=ctx@entry=0x561fd6be19a0) at util/async.c:117
#19 0x0000561fd43a2f74 in aio_dispatch (ctx=0x561fd6be19a0) at util/aio-posix.c:459
#20 0x0000561fd439fa62 in aio_ctx_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>)
    at util/async.c:260
#21 0x00007f7f5a8d467d in g_main_dispatch (context=0x561fd6c70b10) at gmain.c:3176
#22 0x00007f7f5a8d467d in g_main_context_dispatch (context=context@entry=0x561fd6c70b10) at gmain.c:3829
#23 0x0000561fd43a2028 in glib_pollfds_poll () at util/main-loop.c:219
#24 0x0000561fd43a2028 in os_host_main_loop_wait (timeout=<optimized out>) at util/main-loop.c:242
#25 0x0000561fd43a2028 in main_loop_wait (nonblocking=<optimized out>) at util/main-loop.c:518
#26 0x0000561fd41846f1 in main_loop () at vl.c:1828
#27 0x0000561fd4030c02 in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4504

Expected results:
 After step7, operation failed with error info prompted.

Additional info:
 Similar error in bz#1782175.
 Not planed to cover it at present, for it's a negative test case.