Description of problem:
qemu-kvm crashes when trying to hotplug the 161th cpu.


Version-Release number of selected component (if applicable):
qemu-kvm-0.12.1.2-2.382.el6.x86_64
libvirt-0.10.2-21.el6.x86_64

How reproducible:
Always.

Steps to Reproduce:
1. start a guest with 1 actual cpu and 161+ possible vCPUs
when using libvirt:
<vcpu placement='static' current='1'>162</vcpu>

2. hotplug 160 more cpus into the guest
when using libvirt-0.10.2-21.el6.x86_64 (this version has the limit of maximum cpus removed)

virsh setvcpus --live domainname 161

or

use monitor manually.

3. qemu-kvm exits on signal 6

Actual results:
qemu-kvm crashes

Expected results:
qemu-kvm will reject hotplug of the cpu with an error


Additional info:
Core was generated by `/usr/libexec/qemu-kvm -name asdf -S -M rhel6.5.0 -enable-kvm -m 1024 -realtime'.
Program terminated with signal 6, Aborted.
#0  0x00007f2c483f28d5 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64	  return INLINE_SYSCALL (tgkill, 3, pid, selftid, sig);

(gdb) bt
#0  0x00007f2c483f28d5 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00007f2c483f40b5 in abort () at abort.c:92
#2  0x00007f2c4aae0ffb in kvm_create_vcpu (_env=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:475
#3  ap_main_loop (_env=<value optimized out>) at /usr/src/debug/qemu-kvm-0.12.1.2/qemu-kvm.c:2026
#4  0x00007f2c4a4139d1 in start_thread (arg=0x7f2b5f371700) at pthread_create.c:301
#5  0x00007f2c484a8a3d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115

(full backtrace has a lot of threads waiting in do_sigtimedwait, I can attach it if needed)