qemu-kvm segfault in tb_invalidate_phys_page_range()

Issue

• A customer encountered segfault of qemu-kvm process.

Mar 26 23:05:34 xxxxxx kernel: qemu-kvm17231: segfault at 0000000001803030 rip 00000000004a2436 rsp 00007fff818c1b00 error 4

• Here is a backtrace of the segfault.

(gdb) bt
#0  tb_invalidate_phys_page_range (start=4294967314, end=4294967388, is_cpu_write_access=0)
    at /usr/src/debug/kvm-83-maint-snapshot-20090205/qemu/exec.c:944
#1  0x00000000004a2d08 in cpu_physical_memory_rw (addr=5368709138, buf=0xe972e06 "4\357\213\021A\260\064\357\213\021A\300\b", 
    len=74, is_write=1) at /usr/src/debug/kvm-83-maint-snapshot-20090205/qemu/exec.c:3006
#2  0x00000000004218f4 in rtl8139_do_receive (opaque=0xea5bbc0, buf=<value optimized out>, size=74, do_interrupt=1)
    at ../cpu-all.h:925
#3  0x000000000046c81e in qemu_send_packet (vc1=0xe983e10, buf=0xe972e06 "4\357\213\021A\260\064\357\213\021A\300\b", size=74)
    at net.c:431
#4  0x000000000046d1ed in tap_send (opaque=<value optimized out>) at net.c:946
#5  0x0000000000409402 in main_loop_wait (timeout=<value optimized out>)
    at /usr/src/debug/kvm-83-maint-snapshot-20090205/qemu/vl.c:3994
#6  0x00000000004ff9fa in kvm_main_loop () at /usr/src/debug/kvm-83-maint-snapshot-20090205/qemu/qemu-kvm.c:596
#7  0x000000000040e3a5 in main_loop (argc=34, argv=0x7fff818c35f8, envp=<value optimized out>)
    at /usr/src/debug/kvm-83-maint-snapshot-20090205/qemu/vl.c:4051
#8  main (argc=34, argv=0x7fff818c35f8, envp=<value optimized out>)
    at /usr/src/debug/kvm-83-maint-snapshot-20090205/qemu/vl.c:6487

• What is the cause of the segfault?