Qemu Core Dumped When Writing Larger Size Than The Size of A Data Disk

Description of problem:
As subject.

Version-Release number of selected component (if applicable):
qemu-kvm-8.1.0-0.rc4.el9.preview
kernel-5.14.0-340.el9.x86_64

How reproducible:
100%

Steps to Reproduce:
1. Prepare a LV block file

1. qemu-img create -f raw /home/lvm.img 60G
2. losetup /dev/loop1 /home/lvm.img
3. pvcreate /dev/loop1 --metadatasize=1m --metadatacopies=2 --metadataignore=y
4. vgcreate vg /dev/loop1 --physicalextentsize=1m
5. lvcreate --autobackup n --contiguous n --size 1024M -n lv1 vg
6. qemu-img create -f qcow2 /dev/vg/lv1 60G

2. Boot up a guest with the LV as a data disk

1. /usr/libexec/qemu-kvm \
   -S \
   -name 'avocado-vt-vm1' \
   -sandbox on \
   -blockdev ' {"node-name": "file_ovmf_code", "driver": "file", "filename": "/usr/share/OVMF/OVMF_CODE.secboot.fd", "auto-read-only": true, "discard": "unmap"}

   ' \
   -blockdev '

   {"node-name": "drive_ovmf_code", "driver": "raw", "read-only": true, "file": "file_ovmf_code"}

   ' \
   -blockdev '

   {"node-name": "file_ovmf_vars", "driver": "file", "filename": "/root/avocado/data/avocado-vt/avocado-vt-vm1_rhel930-64-virtio-scsi-ovmf_qcow2_filesystem_VARS.raw", "auto-read-only": true, "discard": "unmap"}

   ' \
   -blockdev '

   {"node-name": "drive_ovmf_vars", "driver": "raw", "read-only": false, "file": "file_ovmf_vars"}

   ' \
   -machine q35,pflash0=drive_ovmf_code,pflash1=drive_ovmf_vars,memory-backend=mem-machine_mem \
   -device '

   {"id": "pcie-root-port-0", "driver": "pcie-root-port", "multifunction": true, "bus": "pcie.0", "addr": "0x1", "chassis": 1}

   ' \
   -device '

   {"id": "pcie-pci-bridge-0", "driver": "pcie-pci-bridge", "addr": "0x0", "bus": "pcie-root-port-0"}

   ' \
   -nodefaults \
   -device '

   {"driver": "VGA", "bus": "pcie.0", "addr": "0x2"}

   ' \
   -m 30720 \
   -object '

   {"size": 32212254720, "id": "mem-machine_mem", "qom-type": "memory-backend-ram"}

   ' \
   -smp 10,maxcpus=10,cores=5,threads=1,dies=1,sockets=2 \
   -cpu 'Cascadelake-Server-noTSX',+kvm_pv_unhalt \
   -chardev socket,wait=off,server=on,id=qmp_id_qmpmonitor1,path=/var/tmp/avocado_r9ni1_l3/monitor-qmpmonitor1-20230824-030703-TgoNPdRk \
   -mon chardev=qmp_id_qmpmonitor1,mode=control \
   -chardev socket,wait=off,server=on,id=qmp_id_catch_monitor,path=/var/tmp/avocado_r9ni1_l3/monitor-catch_monitor-20230824-030703-TgoNPdRk \
   -mon chardev=qmp_id_catch_monitor,mode=control \
   -device '

   {"ioport": 1285, "driver": "pvpanic", "id": "idSpXmJe"}

   ' \
   -chardev socket,wait=off,server=on,id=chardev_serial0,path=/var/tmp/avocado_r9ni1_l3/serial-serial0-20230824-030703-TgoNPdRk \
   -device '

   {"id": "serial0", "driver": "isa-serial", "chardev": "chardev_serial0"}

   ' \
   -chardev socket,id=seabioslog_id_20230824-030703-TgoNPdRk,path=/var/tmp/avocado_r9ni1_l3/seabios-20230824-030703-TgoNPdRk,server=on,wait=off \
   -device isa-debugcon,chardev=seabioslog_id_20230824-030703-TgoNPdRk,iobase=0x402 \
   -device '

   {"id": "pcie-root-port-1", "port": 1, "driver": "pcie-root-port", "addr": "0x1.0x1", "bus": "pcie.0", "chassis": 2}

   ' \
   -device '

   {"driver": "qemu-xhci", "id": "usb1", "bus": "pcie-root-port-1", "addr": "0x0"}

   ' \
   -device '

   {"driver": "usb-tablet", "id": "usb-tablet1", "bus": "usb1.0", "port": "1"}

   ' \
   -device '

   {"id": "pcie-root-port-2", "port": 2, "driver": "pcie-root-port", "addr": "0x1.0x2", "bus": "pcie.0", "chassis": 3}

   ' \
   -device '

   {"id": "virtio_scsi_pci0", "driver": "virtio-scsi-pci", "bus": "pcie-root-port-2", "addr": "0x0"}

   ' \
   -blockdev '{"node-name": "file_image1", "driver": "file", "auto-read-only": true, "discard": "unmap", "aio": "threads", "filename": "/home/kvm_autotest_root/images/rhel930-64-virtio-scsi-ovmf.qcow2", "cache": {"direct": true, "no-flush": false}}' \
   -blockdev '

   Unknown macro: {"node-name"}

   ' \
   -device '

   {"driver": "scsi-hd", "id": "image1", "drive": "drive_image1", "write-cache": "on"}

   ' \
   -blockdev '{"node-name": "file_stg1", "driver": "host_device", "auto-read-only": true, "discard": "unmap", "aio": "threads", "filename": "/dev/vg/lv1", "cache": {"direct": true, "no-flush": false}}' \
   -blockdev '

   Unknown macro: {"node-name"}

   ' \
   -device '

   {"driver": "scsi-hd", "id": "stg1", "drive": "drive_stg1", "write-cache": "on", "rerror": "stop", "werror": "stop", "serial": "TARGET_DISK0"}

   ' \
   -device '

   {"id": "pcie-root-port-3", "port": 3, "driver": "pcie-root-port", "addr": "0x1.0x3", "bus": "pcie.0", "chassis": 4}

   ' \
   -device '

   {"driver": "virtio-net-pci", "mac": "9a:c4:b4:6c:7c:ec", "id": "id9xdoY8", "netdev": "idXoIpNF", "bus": "pcie-root-port-3", "addr": "0x0"}

   ' \
   -netdev tap,id=idXoIpNF,vhost=on \
   -vnc :0 \
   -rtc base=utc,clock=host,driftfix=slew \
   -boot menu=off,order=cdn,once=c,strict=off \
   -enable-kvm \
   -monitor stdio \
   -device '

   {"id": "pcie_extra_root_port_0", "driver": "pcie-root-port", "multifunction": true, "bus": "pcie.0", "addr": "0x3", "chassis": 5}

   '

3. Write data to the data disk in guest
(guest)# dd if=/dev/urandom of=/dev/sdb bs=1M count=50000 oflag=direct

Actual results:
After about several sec/1 minute, the qemu coredumped
(qemu) qemu.sh: line 46: 20707 Floating point exception(core dumped) /usr/libexec/qemu-kvm -S -name 'avocado-vt-vm1' -sandbox on -blockdev '

{"node-name": "file_ovmf_code", "driver": "file", "filename": "/usr/share/OVMF/OVMF_CODE.secboot.fd", "auto-read-only": true, "discard": "unmap"}

' -blockdev '

{"node-name": "drive_ovmf_code", "driver": "raw", "read-only": true, "file": "file_ovmf_code"}

' -blockdev '

{"node-name": "file_ovmf_vars", "driver": "file", "filename": "/root/avocado/data/avocado-vt/avocado-vt-vm1_rhel930-64-virtio-scsi-ovmf_qcow2_filesystem_VARS.raw", "auto-read-only": true, "discard": "unmap"}

' -blockdev '

{"node-name": "drive_ovmf_vars", "driver": "raw", "read-only": false, "file": "file_ovmf_vars"}

' -machine q35,pflash0=drive_ovmf_code,pflash1=drive_ovmf_vars,memory-backend=mem-machine_mem -device '

{"id": "pcie-root-port-0", "driver": "pcie-root-port", "multifunction": true, "bus": "pcie.0", "addr": "0x1", "chassis": 1}

' -device '

{"id": "pcie-pci-bridge-0", "driver": "pcie-pci-bridge", "addr": "0x0", "bus": "pcie-root-port-0"}

' -nodefaults -device '

{"driver": "VGA", "bus": "pcie.0", "addr": "0x2"}

' -m 30720 -object '

{"size": 32212254720, "id": "mem-machine_mem", "qom-type": "memory-backend-ram"}

' -smp 10,maxcpus=10,cores=5,threads=1,dies=1,sockets=2 -cpu 'Cascadelake-Server-noTSX',+kvm_pv_unhalt -chardev socket,wait=off,server=on,id=qmp_id_qmpmonitor1,path=/var/tmp/avocado_r9ni1_l3/monitor-qmpmonitor1-20230824-030703-TgoNPdRk -mon chardev=qmp_id_qmpmonitor1,mode=control -chardev socket,wait=off,server=on,id=qmp_id_catch_monitor,path=/var/tmp/avocado_r9ni1_l3/monitor-catch_monitor-20230824-030703-TgoNPdRk -mon chardev=qmp_id_catch_monitor,mode=control -device '

{"ioport": 1285, "driver": "pvpanic", "id": "idSpXmJe"}

' -chardev socket,wait=off,server=on,id=chardev_serial0,path=/var/tmp/avocado_r9ni1_l3/serial-serial0-20230824-030703-TgoNPdRk -device '

{"id": "serial0", "driver": "isa-serial", "chardev": "chardev_serial0"}

' -chardev socket,id=seabioslog_id_20230824-030703-TgoNPdRk,path=/var/tmp/avocado_r9ni1_l3/seabios-20230824-030703-TgoNPdRk,server=on,wait=off -device isa-debugcon,chardev=seabioslog_id_20230824-030703-TgoNPdRk,iobase=0x402 -device '

{"id": "pcie-root-port-1", "port": 1, "driver": "pcie-root-port", "addr": "0x1.0x1", "bus": "pcie.0", "chassis": 2}

' -device '

{"driver": "qemu-xhci", "id": "usb1", "bus": "pcie-root-port-1", "addr": "0x0"}

' -device '

{"driver": "usb-tablet", "id": "usb-tablet1", "bus": "usb1.0", "port": "1"}

' -device '

{"id": "pcie-root-port-2", "port": 2, "driver": "pcie-root-port", "addr": "0x1.0x2", "bus": "pcie.0", "chassis": 3}

' -device '

{"id": "virtio_scsi_pci0", "driver": "virtio-scsi-pci", "bus": "pcie-root-port-2", "addr": "0x0"}

' -blockdev '{"node-name": "file_image1", "driver": "file", "auto-read-only": true, "discard": "unmap", "aio": "threads", "filename": "/home/kvm_autotest_root/images/rhel930-64-virtio-scsi-ovmf.qcow2", "cache": {"direct": true, "no-flush": false}}' -blockdev '{"node-name": "drive_image1", "driver": "qcow2", "read-only": false, "cache":

{"direct": true, "no-flush": false}

, "file": "file_image1"}' -device '

{"driver": "scsi-hd", "id": "image1", "drive": "drive_image1", "write-cache": "on"}

' -blockdev '{"node-name": "file_stg1", "driver": "host_device", "auto-read-only": true, "discard": "unmap", "aio": "threads", "filename": "/dev/vg/lv1", "cache": {"direct": true, "no-flush": false}}' -blockdev '{"node-name": "drive_stg1", "driver": "qcow2", "read-only": false, "cache":

{"direct": true, "no-flush": false}

, "file": "file_stg1"}' -device '

{"driver": "scsi-hd", "id": "stg1", "drive": "drive_stg1", "write-cache": "on", "rerror": "stop", "werror": "stop", "serial": "TARGET_DISK0"}

' -device '

{"id": "pcie-root-port-3", "port": 3, "driver": "pcie-root-port", "addr": "0x1.0x3", "bus": "pcie.0", "chassis": 4}

' -device '

{"driver": "virtio-net-pci", "mac": "9a:c4:b4:6c:7c:ec", "id": "id9xdoY8", "netdev": "idXoIpNF", "bus": "pcie-root-port-3", "addr": "0x0"}

' -netdev tap,id=idXoIpNF,vhost=on -vnc :0 -rtc base=utc,clock=host,driftfix=slew -boot menu=off,order=cdn,once=c,strict=off -enable-kvm -monitor stdio -device '

{"id": "pcie_extra_root_port_0", "driver": "pcie-root-port", "multifunction": true, "bus": "pcie.0", "addr": "0x3", "chassis": 5}

'

Expected results:
No core dumped.

Additional info:
Stack trace of thread 20707:
#0 0x0000557f25964609 get_zones_wp (qemu-kvm + 0x86b609)
#1 0x0000557f25964b27 raw_co_prw (qemu-kvm + 0x86bb27)
#2 0x0000557f2590a914 bdrv_driver_pwritev (qemu-kvm + 0x811914)
#3 0x0000557f2590527d bdrv_aligned_pwritev (qemu-kvm + 0x80c27d)
#4 0x0000557f259048d3 bdrv_co_pwritev_part (qemu-kvm + 0x80b8d3)
#5 0x0000557f25942389 qcow2_co_pwritev_task (qemu-kvm + 0x849389)
#6 0x0000557f25941e63 qcow2_co_pwritev_task_entry (qemu-kvm + 0x848e63)
#7 0x0000557f2594163a qcow2_add_task (qemu-kvm + 0x84863a)
#8 0x0000557f2593978c qcow2_co_pwritev_part (qemu-kvm + 0x84078c)
#9 0x0000557f2590a7ea bdrv_driver_pwritev (qemu-kvm + 0x8117ea)
#10 0x0000557f2590527d bdrv_aligned_pwritev (qemu-kvm + 0x80c27d)
#11 0x0000557f259048d3 bdrv_co_pwritev_part (qemu-kvm + 0x80b8d3)
#12 0x0000557f258ef8a6 blk_co_do_pwritev_part.llvm.4925601650272942953 (qemu-kvm + 0x7f68a6)
#13 0x0000557f258f01d2 blk_aio_write_entry.llvm.4925601650272942953 (qemu-kvm + 0x7f71d2)
#14 0x0000557f25ae0006 coroutine_trampoline.llvm.17812621179749689021 (qemu-kvm + 0x9e7006)
#15 0x00007f4aa1e2a360 n/a (libc.so.6 + 0x2a360)
#16 0x40a47d7e8f1e8300 n/a (n/a + 0x0)
ELF object binary architecture: AMD x86-64