sd_init() generates SIGSEGV when passed NULL

Ran into a bug following the following tutorial:
http://balau82.wordpress.com/2010/03/10/u-boot-for-arm-on-qemu/ 

I built QEMU from a clone of master and became stuck at the beginning part of the tutorial where only u-boot.bin is exectuted.

http://git.qemu.org/?p=qemu.git;a=commitdiff;h=4f8a066b5fc254eeaabbbde56ba4f5b29cc68fdf 
See the modifications to sd.c specifically. 

When sd_init (sd.c) is called from pl181_init(), bs is potentially null:
s->card = sd_init(dinfo ? dinfo->bdrv : NULL, false); 

sd_init()  :
SDState *sd_init(BlockDriverState *bs, bool is_spi) 
{ 
    SDState *sd; 
 
    sd = (SDState *) g_malloc0(sizeof(SDState)); 
    sd->buf = qemu_blockalign(bs, 512); 
    sd->spi = is_spi; 
    sd->enable = true; 
    sd_reset(sd, bs); 
    if (sd->bdrv) { 
        bdrv_attach_dev_nofail(sd->bdrv, sd); 
        bdrv_set_dev_ops(sd->bdrv, &sd_block_ops, sd); 
    } 
    vmstate_register(NULL, -1, &sd_vmstate, sd); 
    return sd; 
}

Line 497 calls bdrv_is_read_only(bs) (from block.c)and this generates a SEGSIGV.

int bdrv_is_read_only(BlockDriverState *bs)                                                           
{                                                                                                     
    return bs->read_only;                                                                             
} 

Checking out tag v1.6.1 reverted the problem.  Thanks!