Description of problem:

qemu-kvm segmentation fault when doing network hotplug and do set_link operations.

Version-Release number of selected component (if applicable):
kernel: 3.9.0-0.55.el7.x86_64
qemu-kvm-1.5.2-1.el7.x86_64

How reproducible:

Once

Steps to Reproduce:
1. Start guest
/usr/local/staf/test/RHEV/kvm/autotest-devel/client/tests/virt/qemu/qemu \
    -name 'virt-tests-vm1' \
    -nodefaults \
    -monitor stdio \
    -device ich9-usb-uhci1,id=usb1,bus=pci.0,addr=0x4 \
    -drive file='win7-64.qcow2',index=0,if=none,id=drive-ide0-0-0,media=disk,cache=none,snapshot=off,format=qcow2,aio=native \
    -device ide-drive,bus=ide.0,unit=0,drive=drive-ide0-0-0 \
    -device rtl8139,netdev=idMLI3A0,mac='9a:f5:f6:f7:f8:f9',bus=pci.0,addr=0x3,id='idngaiUo' \
    -netdev tap,id=idMLI3A0,script=qemu-ifup-switch \
    -m 2048 \
    -smp 2,maxcpus=2,cores=1,threads=1,sockets=2 \
    -cpu 'Penryn',hv_relaxed \
    -M pc \
    -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1 \
    -spice port=5000,password=123456,addr=0,image-compression=auto_glz,zlib-glz-wan-compression=auto,streaming-video=all,agent-mouse=on,playback-compression=on,ipv4 \
    -vga qxl \
    -global qxl-vga.vram_size=33554432 \
    -rtc base=localtime,clock=host,driftfix=slew  \
    -boot order=cdn,once=c,menu=off  \
    -enable-kvm \
    -qmp tcp::1234,server,nowait

2. Connect with qmp session
    telnet pc_ip 1234
   and launch 
    {'execute': 'qmp_capabilities'}
 
3. Add network devices through monitor cmd
{ "execute": "netdev_add", "arguments": { "type":"tap","id":"hostnet2","vhost":"on"}}
{"execute": "device_add", "arguments": { "driver":"virtio-net-pci","netdev":"hostnet2","mac":"22:11:22:45:61:97","id": "net2"}}

4. 
Sending command "info network" via human monitor

5:
 Disable the primary link(s) of guest

 {'execute': 'set_link', 'arguments': {'name': 'idngaiUo', 'up': False}}

6: repeat step 3 to step 5 several times.

Actual results:

  qemu-kvm segmentation fault.


Expected results:

  network device can work normally.


Additional info:

(gdb) bt
#0  0x00007f622191adc3 in dispatcher_handle_recv_read () from /lib64/libspice-server.so.1
#1  0x00007f622193d42d in red_worker_main () from /lib64/libspice-server.so.1
#2  0x00007f62234e3c53 in start_thread () from /lib64/libpthread.so.0
#3  0x00007f6220c6a13d in clone () from /lib64/libc.so.6