Description of problem:
Hotplug then hot unplug a virtio disk to guest for several times (I did about 5 cycles) then reboot guest. Guest got segmentation fault.

Version-Release number of selected component (if applicable):
kernel-2.6.18-260.el5
kvm-83-232.el5

How reproducible:
Always

Steps to Reproduce:
1.Boot a guest:
/usr/libexec/qemu-kvm -m 2048 -smp 2,sockets=2,cores=1,threads=1 -name rhel5.7-64 -uuid b438cbb7-9252-4333-88c0-a3aef16e4505 -no-kvm-pit-reinjection -boot c -drive file=boot.iso,if=ide,media=cdrom,bus=1,unit=0,readonly=on,format=raw -drive file=rhel5.7-64-virtio.qcow2,if=virtio,boot=on,format=qcow2 -net nic,macaddr=00:12:00:61:b6:33,vlan=0,model=virtio -net tap,vlan=0,script=/etc/qemu-ifup -vnc :10 -k en-us -vga cirrus -balloon virtio -monitor stdio

2.Inside guest: #modprobe acpiphp

3.Hot plug a virtio disk to guest in qemu monitor:
(qemu)pci_add pci_addr=auto storage file=disk31.qcow2,if=virtio

4.Check in qemu monitor about pci info:
(qemu)info pci

5.Hot unplug the virtio disk:
(qemu)pci_del pci_addr=0:0x6

6.Repeat ste 3~6 for about 5 times.

7. Reboot guest inside guest or system_reset in qemu monitor.

  
Actual results:
Guest got segmentation fault.

Expected results:
Guest should boot up successfully.

Additional info:

dmesg in host:

qemu-kvm[14510]: segfault at 0000003ee5006b6c rip 0000000000415eae rsp 00007ffff7b474d8 error 4


(gdb) bt
#0  0x0000003ee5553a68 in main_arena () from /lib64/libc.so.6
#1  0x0000000000415fb2 in virtio_reset (opaque=0xe9f910)
    at /usr/src/debug/kvm-83-maint-snapshot-20090205/qemu/hw/virtio.c:494
#2  0x0000000000407766 in qemu_system_reset ()
    at /usr/src/debug/kvm-83-maint-snapshot-20090205/qemu/vl.c:3942
#3  0x00000000005011c6 in qemu_kvm_system_reset ()
    at /usr/src/debug/kvm-83-maint-snapshot-20090205/qemu/qemu-kvm.c:369
#4  kvm_main_loop () at /usr/src/debug/kvm-83-maint-snapshot-20090205/qemu/qemu-kvm.c:604
#5  0x000000000040e757 in main_loop (argc=30, argv=0x7fffffffe778, envp=<value optimized out>)
    at /usr/src/debug/kvm-83-maint-snapshot-20090205/qemu/vl.c:4157
#6  main (argc=30, argv=0x7fffffffe778, envp=<value optimized out>)
    at /usr/src/debug/kvm-83-maint-snapshot-20090205/qemu/vl.c:6559