Description of problem:

Boot guest with a data disks, then do live block copy  on datadisk. During live block copy  remove this data disk, qemu-kvm gets Segmentation fault.

Version-Release number of selected component (if applicable):
# uname -r;rpm -q qemu-kvm
2.6.32-251.el6.x86_64
qemu-kvm-0.12.1.2-2.265.el6rhev.x86_64

How reproducible:
2/2

Steps to Reproduce:
1.Boot guest with a data disk

2.Do block_stream on the data disk,
e.g.
(qemu) snapshot_blkdev datadisk /dev/disk/by-path/ip-10.66.90.100:3260-iscsi-iqn.2001-05.com.equallogic:0-8a0906-3aa1f7d03-bdaf49b25d14f5d6-s2-wdai-145515-lun-0 qcow2
(qemu) block_stream datadisk

3.During live block copy ,remove this data disk
e.g.
(qemu) device_del datadisk1

qemu-kvm command line:


   r -cpu SandyBridge -rtc base=localtime,clock=host,driftfix=slew -M rhel6.3.0 -enable-kvm -name rhel6.3-64 -smp 2,cores=2,threads=1,sockets=1 -m 4G -uuid c2b21082-bee1-41eb-a7fa-494782cd7128 -boot menu=on -drive file=/dev/wdai_test/blklv2,if=none,id=virtio-scsi-disk0,format=qcow2,cache=none,aio=native,media=disk,werror=stop,rerror=stop -device virtio-scsi-pci,id=scsibus1 -device scsi-hd,drive=virtio-scsi-disk0,bus=scsibus1.0,scsi-id=0,lun=0,id=lun0,bootindex=1 -netdev tap,id=hostnet0,vhost=on,script=/etc/qemu-ifup -device virtio-net-pci,netdev=hostnet0,id=net0,mac=44:37:E6:5E:A3:F7 -spice port=9000,disable-ticketing -vga qxl -monitor stdio -usb -device usb-tablet,id=input1 -serial unix:/home/wdai-live-blk,server,nowait -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x6 -drive file=/home/datadisk.qcow2,if=none,format=qcow2,cache=none,aio=native,media=disk,werror=stop,rerror=stop,id=datadisk -device scsi-hd,drive=datadisk,bus=scsibus1.0,scsi-id=0,lun=1,id=datadisk1

Actual results:

(qemu)
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7e1eea8 in bdrv_co_is_allocated (bs=0x7ffff8853430, sector_num=4508672, nb_sectors=1024, pnum=0x7fffe2c35bec) at block.c:2120
2120        if (!bs->drv->bdrv_co_is_allocated) {
(gdb) bt
#0  0x00007ffff7e1eea8 in bdrv_co_is_allocated (bs=0x7ffff8853430, sector_num=4508672, nb_sectors=1024, pnum=0x7fffe2c35bec) at block.c:2120
#1  0x00007ffff7e40625 in stream_run (opaque=0x7ffff8aadac0) at block/stream.c:183
#2  0x00007ffff7e2696b in coroutine_trampoline (i0=<value optimized out>, i1=<value optimized out>) at coroutine-ucontext.c:129
#3  0x00007ffff5789630 in ?? () from /lib64/libc.so.6
#4  0x00007fffee55a530 in ?? ()
#5  0x0000000000000000 in ?? ()

Expected results:

After step 3, the data disk should exist during live block copy, after live block copy finish correctly, it is removed automatically.

Additional info: