Description of problem:
Description of problem:
kvm host hungs up when guset os are using virtio_net driver.


How reproducible:
100%

Steps to Reproduce:
1. create guest vm that using virtio_net.
e.g) I used centos6.4 as guest os.
<domain type='kvm'>
  <name>master-centos6</name>
  <uuid>8b3ee610-fbab-3f0b-ccac-663562cd0643</uuid>
  <memory unit='KiB'>1048576</memory>
  <currentMemory unit='KiB'>1048576</currentMemory>
  <vcpu placement='static'>1</vcpu>
  <os>
    <type arch='x86_64' machine='pc-1.2'>hvm</type>
    <boot dev='hd'/>
  </os>
  <features>
    <acpi/>
    <apic/>
    <pae/>
  </features>
  <clock offset='utc'/>
  <on_poweroff>destroy</on_poweroff>
  <on_reboot>restart</on_reboot>
  <on_crash>restart</on_crash>
  <devices>
    <emulator>/usr/bin/qemu-kvm</emulator>
    <disk type='file' device='disk'>
      <driver name='qemu' type='qcow2'/>
      <source file='/var/lib/libvirt/images/master-centos6.qcow2'/>
      <target dev='vda' bus='virtio'/>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
    </disk>
    <controller type='usb' index='0'>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
    </controller>
    <controller type='virtio-serial' index='0'>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/>
    </controller>
    <interface type='network'>
      <mac address='52:54:00:76:ce:65'/>
      <source network='default'/>
      <model type='virtio'/>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
    </interface>
    <serial type='pty'>
      <target port='0'/>
    </serial>
    <console type='pty'>
      <target type='serial' port='0'/>
    </console>
    <channel type='spicevmc'>
      <target type='virtio' name='com.redhat.spice.0'/>
      <address type='virtio-serial' controller='0' bus='0' port='1'/>
    </channel>
    <input type='tablet' bus='usb'/>
    <input type='mouse' bus='ps2'/>
    <graphics type='spice' autoport='yes'/>
    <sound model='ich6'>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
    </sound>
    <video>
      <model type='qxl' vram='65536' heads='1'/>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
    </video>
    <memballoon model='virtio'>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
    </memballoon>
  </devices>
</domain>

2. boot guest vm & reboot it
at this time, kvm host hungs up about once to 3times. 

3. this problem dosen't occur when virtio_net of guest os was disabled via guest os boot parameters.
e.g)
    <interface type='network'>
      <mac address='52:54:00:76:ce:65'/>
      <source network='default'/>
      <model type='e1000'/>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
    </interface>

Additional info:
reporter:       libreport-2.1.5
general protection fault: 0000 [#1] SMP 
Modules linked in: vhost_net macvtap macvlan fuse ebtable_nat xt_CHECKSUM nf_conntrack_netbios_ns nf_conntrack_broadcast ipt_MASQUERADE ip6table_nat nf_nat_ipv6 tun ip6table_mangle bridge stp llc ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 iptable_nat nf_nat_ipv4 nf_nat iptable_mangle nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ebtable_filter ebtables ip6table_filter ip6_tables rfcomm bnep rtsx_pci_sdmmc mmc_core rtsx_pci_ms memstick iTCO_wdt iTCO_vendor_support mperf coretemp kvm_intel kvm crc32_pclmul crc32c_intel ghash_clmulni_intel snd_hda_codec_hdmi microcode snd_hda_codec_conexant serio_raw arc4 i2c_i801 snd_hda_intel snd_hda_codec rtl8192ce uvcvideo rtlwifi snd_hwdep videobuf2_vmalloc videobuf2_memops rtl8192c_common snd_seq videobuf2_core videodev snd_seq_device mac80211 media snd_pcm joydev btusb cfg80211 bluetooth atl1c rtsx_pci lpc_ich snd_page_alloc mfd_core snd_timer mei wmi thinkpad_acpi snd soundcore rfkill tpm_tis tpm tpm_bios uinput i915 i2c_algo_bit drm_kms_helper drm i2c_core video
CPU 1 
Pid: 481, comm: libvirtd Not tainted 3.9.8-300.fc19.x86_64 #1 LENOVO 3045CTO/3045CTO
RIP: 0010:[<ffffffff81181a28>]  [<ffffffff81181a28>] __kmalloc+0x88/0x250
RSP: 0018:ffff8802173cdcc8  EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88022dba8e38 RCX: ffff8802173cdfd8
RDX: 000000000003e495 RSI: 0000000000000000 RDI: 0000000000000007
RBP: ffff8802173cdd08 R08: 0000000000016d60 R09: ffffffff812176c4
R10: ffff880237002700 R11: 00000000004c19e3 R12: 00000000000080d0
R13: 7296de79e2d319ba R14: 000000000000003b R15: ffff880237002700
FS:  00007f915bb51700(0000) GS:ffff88023fa40000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8aa4605fa8 CR3: 000000021715d000 CR4: 00000000000427e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process libvirtd (pid: 481, threadinfo ffff8802173cc000, task ffff8802173c4650)
Stack:
 ffff8802173cdd40 ffffffff8124418d ffffffff812176c4 ffff88022dba8e38
 ffff8802132c4100 ffff88022ad1e0fc 0000000015f5a57c 000000005df56c0d
 ffff8802173cdd40 ffffffff812176c4 ffff88022dba8e38 ffff8802173cddd8
Call Trace:
 [<ffffffff8124418d>] ? ext4fs_dirhash+0xad/0x290
 [<ffffffff812176c4>] ? ext4_htree_store_dirent+0x34/0x120
 [<ffffffff812176c4>] ext4_htree_store_dirent+0x34/0x120
 [<ffffffff81225b79>] htree_dirblock_to_tree+0x169/0x1c0
 [<ffffffff81226837>] ext4_htree_fill_tree+0x77/0x1e0
 [<ffffffff8118228f>] ? kmem_cache_alloc_trace+0x1cf/0x230
 [<ffffffff81217594>] ? ext4_readdir+0x6e4/0x7c0
 [<ffffffff81217397>] ext4_readdir+0x4e7/0x7c0
 [<ffffffff811aba30>] ? fillonedir+0xf0/0xf0
 [<ffffffff811aba30>] ? fillonedir+0xf0/0xf0
 [<ffffffff811aba30>] ? fillonedir+0xf0/0xf0
 [<ffffffff811ab800>] vfs_readdir+0xb0/0xe0
 [<ffffffff811abc56>] sys_getdents+0x86/0x120
 [<ffffffff8164efd9>] system_call_fastpath+0x16/0x1b
Code: 90 4d 89 fa 4d 8b 02 65 4c 03 04 25 c8 db 00 00 49 8b 50 08 4d 8b 28 4d 85 ed 0f 84 73 01 00 00 49 63 42 20 4d 8b 02 41 f6 c0 0f <49> 8b 5c 05 00 0f 85 2c 01 00 00 48 8d 4a 01 4c 89 e8 65 49 0f 
RIP  [<ffffffff81181a28>] __kmalloc+0x88/0x250
 RSP <ffff8802173cdcc8>

Potential duplicate: bug 965330