(qemu) device_del virtio-serial0
(qemu) 
Program received signal SIGSEGV, Segmentation fault.
0x0000000000000000 in ?? ()
(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x000000000040c546 in main_loop_wait (timeout=1000) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:3890
#2  0x000000000042a63a in kvm_main_loop () at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:2194
#3  0x000000000040dc9f in main_loop (argc=<value optimized out>, argv=<value optimized out>, 
    envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4095
#4  main (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>)
    at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:6323

*** Bug 759011 has been marked as a duplicate of this bug. ***

Backtrace from recent qemu from bug 759011

Core was generated by `/usr/libexec/qemu-kvm -M rhel6.2.0 -enable-kvm -m 2048
-smp 2,sockets=2,cores=1'.
Program terminated with signal 11, Segmentation fault.
#0  0x0000000000000000 in ?? ()
(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x000000000040c5ce in main_loop_wait (timeout=1000) at
/usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4029
#2  0x000000000042aefa in kvm_main_loop () at
/usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:2225
#3  0x000000000040de85 in main_loop (argc=<value optimized out>, argv=<value
optimized out>, envp=<value optimized out>)
    at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4234
#4  main (argc=<value optimized out>, argv=<value optimized out>, envp=<value
optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:6470

vl.c:4029 is:

main_loop_wait():

        QLIST_FOREACH(ioh, &io_handlers, next) {
            if (!ioh->deleted && ioh->fd_read && FD_ISSET(ioh->fd, &rfds)) {
                ioh->fd_read(ioh->opaque);
                if (!(ioh->fd_read_poll && ioh->fd_read_poll(ioh->opaque)))
                    FD_CLR(ioh->fd, &rfds);
            }
            if (!ioh->deleted && ioh->fd_write && FD_ISSET(ioh->fd, &wfds)) {
4029:           ioh->fd_write(ioh->opaque);
            }
        }


That explains what happens: output from guest gets throttled, callback gets registered (qemu-char.c:char_write_unblocked()).  In the meantime, the device is yanked off, resulting in chr's handlers becoming NULL, resulting in this segfault when the char device becomes writable again.

Fix will be RHEL-only, since the throttling patches aren't upstream.

For testing, please test both, linux and windows guests.  From the comments in bug 759011, this bug is easily reproducible in windows guests but not linux guests (but the guest type doesn't really matter -- what matters is the throttling gets activated and the device is removed when throttling is on).

Reproduced the bug on qemu-kvm-0.12.1.2-2.209.el6 and verified pass on qemu-kvm-0.12.1.2-2.221.el6 with the same steps as bug description. 
Note: In the step 3 when reading data from virtio serial on the host side, no need to redirect the output to a file, otherwise it will be hard to reproduce.

On qemu-kvm-0.12.1.2-2.209.el6:
(qemu) device_del virtio-serial0
(qemu) 
Program received signal SIGSEGV, Segmentation fault.
0x0000000000000000 in ?? ()
(gdb) 
(gdb) 
(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x000000000040c5ce in main_loop_wait (timeout=1000)
    at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4029
#2  0x000000000042aefa in kvm_main_loop ()
    at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:2225
#3  0x000000000040de85 in main_loop (argc=<value optimized out>, 
    argv=<value optimized out>, envp=<value optimized out>)
    at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:4234
#4  main (argc=<value optimized out>, argv=<value optimized out>, 
    envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/vl.c:6470

On qemu-kvm-0.12.1.2-2.221.el6, after several times attempts, no segment fault happens. The device can be removed successfully and guest works well. 

So this issue is fixed.

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
No documentation necessary

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0746.html