Steps to reproduce
1. Boot VM
/usr/libexec/qemu-kvm \
     -name 'avocado-vt-vm1'  \
     -sandbox on \
     -machine pc,memory-backend=mem-machine_mem  \
     -nodefaults \
     -device '{"driver": "VGA", "bus": "pci.0", "addr": "0x2"}' \
     -m 12288 \
     -object '{"size": 12884901888, "id": "mem-machine_mem", "qom-type": "memory-backend-ram"}'  \
     -smp 48,maxcpus=48,cores=24,threads=1,dies=1,sockets=2  \
     -cpu 'Icelake-Server-noTSX',+kvm_pv_unhalt \
     \
     -device '{"driver": "ich9-usb-ehci1", "id": "usb1", "addr": "0x1d.0x7", "multifunction": true, "bus": "pci.0"}' \
     -device '{"driver": "ich9-usb-uhci1", "id": "usb1.0", "multifunction": true, "masterbus": "usb1.0", "addr": "0x1d.0x0", "firstport": 0, "bus": "pci.0"}' \
     -device '{"driver": "ich9-usb-uhci2", "id": "usb1.1", "multifunction": true, "masterbus": "usb1.0", "addr": "0x1d.0x2", "firstport": 2, "bus": "pci.0"}' \
     -device '{"driver": "ich9-usb-uhci3", "id": "usb1.2", "multifunction": true, "masterbus": "usb1.0", "addr": "0x1d.0x4", "firstport": 4, "bus": "pci.0"}' \
     -device '{"driver": "usb-tablet", "id": "usb-tablet1", "bus": "usb1.0", "port": "1"}' \
     -object '{"qom-type": "iothread", "id": "iothread0"}' \
     -object '{"qom-type": "iothread", "id": "iothread1"}' \
     -device '{"id": "virtio_scsi_pci0", "driver": "virtio-scsi-pci", "bus": "pci.0", "addr": "0x3", "iothread": "iothread0"}' \
     -blockdev '{"node-name": "file_image1", "driver": "file", "auto-read-only": true, "discard": "unmap", "aio": "threads", "filename": "/home/kvm_autotest_root/images/rhel940-64-virtio-scsi.qcow2", "cache": {"direct": true, "no-flush": false}}' \
     -blockdev '{"node-name": "drive_image1", "driver": "qcow2", "read-only": false, "cache": {"direct": true, "no-flush": false}, "file": "file_image1"}' \
     -device '{"driver": "scsi-hd", "id": "image1", "drive": "drive_image1", "write-cache": "on"}' \
     -blockdev '{"node-name": "file_stg0", "driver": "file", "auto-read-only": true, "discard": "unmap", "aio": "threads", "filename": "/home/kvm_autotest_root/images/stg0.qcow2", "cache": {"direct": true, "no-flush": false}}' \
     -blockdev '{"node-name": "drive_stg0", "driver": "qcow2", "read-only": false, "cache": {"direct": true, "no-flush": false}, "file": "file_stg0"}' \
     -device '{"driver": "scsi-hd", "id": "stg0", "bus": "virtio_scsi_pci0.0", "drive": "drive_stg0", "write-cache": "on", "lun": 1}' \
     -blockdev '{"node-name": "file_stg1", "driver": "file", "auto-read-only": true, "discard": "unmap", "aio": "threads", "filename": "/home/kvm_autotest_root/images/stg1.qcow2", "cache": {"direct": true, "no-flush": false}}' \
     -blockdev '{"node-name": "drive_stg1", "driver": "qcow2", "read-only": false, "cache": {"direct": true, "no-flush": false}, "file": "file_stg1"}' \
     -device '{"driver": "scsi-hd", "id": "stg1", "bus": "virtio_scsi_pci0.0", "drive": "drive_stg1", "write-cache": "on", "lun": 2}' \
     -blockdev '{"node-name": "file_stg2", "driver": "file", "auto-read-only": true, "discard": "unmap", "aio": "threads", "filename": "/home/kvm_autotest_root/images/stg2.qcow2", "cache": {"direct": true, "no-flush": false}}' \
     -blockdev '{"node-name": "drive_stg2", "driver": "qcow2", "read-only": false, "cache": {"direct": true, "no-flush": false}, "file": "file_stg2"}' \
     -device '{"driver": "scsi-hd", "id": "stg2", "bus": "virtio_scsi_pci0.0", "drive": "drive_stg2", "write-cache": "on", "lun": 3}' \
     -device '{"driver": "virtio-net-pci", "mac": "9a:70:f5:12:f4:23", "id": "idQeOME7", "netdev": "idhhqCth", "bus": "pci.0", "addr": "0x4"}' \
     -netdev  '{"id": "idhhqCth", "type": "tap", "vhost": true }'  \
     -vnc :0  \
     -rtc base=utc,clock=host,driftfix=slew  \
     -boot menu=off,order=cdn,once=c,strict=off \
     -enable-kvm

2.unplug disk
{"execute": "device_del", "arguments": {"id": "stg1"}, "id": "09NK2PLp"}
{"execute": "device_del", "arguments": {"id": "stg2"}, "id": "ptCk7lLv"}

3.hotplug disk
{"execute": "device_add", "arguments": {"driver": "scsi-hd", "id": "stg1", "bus": "virtio_scsi_pci0.0", "drive": "drive_stg1", "write-cache": "on", "lun": 2}, "id": "Amk9O4wH"}
{"execute": "device_add", "arguments": {"driver": "scsi-hd", "id": "stg2", "bus": "virtio_scsi_pci0.0", "drive": "drive_stg2", "write-cache": "on", "lun": 3}, "id": "wTkAmFXi"}

4.repeat step 2-3 3000 times

Expected results
guest may login

Actual results
qemu crash
  

BT：
#0  0x00007f80758a365c __pthread_kill_implementation (libc.so.6 + 0xa365c)
#1  0x00007f8075854d06 raise (libc.so.6 + 0x54d06)
#2  0x00007f80758287f3 abort (libc.so.6 + 0x287f3)
#3  0x00007f807582871b __assert_fail_base.cold (libc.so.6 + 0x2871b)
#4  0x00007f807584dca6 __assert_fail (libc.so.6 + 0x4dca6)
#5  0x000055b1b429a831 scsi_device_for_each_req_async_bh.llvm.9308729181196144621 (qemu>
#6  0x000055b1b47e6261 aio_bh_poll (qemu-kvm + 0xa2e261)
#7  0x000055b1b47ca18e aio_poll (qemu-kvm + 0xa1218e)
#8  0x000055b1b45b43c2 iothread_run (qemu-kvm + 0x7fc3c2)
#9  0x000055b1b47ce76a qemu_thread_start.llvm.17470779946278888225 (qemu-kvm + 0xa1676a)
#10 0x00007f80758a1912 start_thread (libc.so.6 + 0xa1912)
#11 0x00007f807583f450 __clone3 (libc.so.6 + 0x3f450)                  


It does not hit this issue on
Red Hat Enterprise Linux release 9.4 Beta (Plow)
5.14.0-373.el9.x86_64
qemu-kvm-8.0.0-16.el9_3.x86_64
seabios-bin-1.16.1-1.el9.noarch
edk2-ovmf-20230524-4.el9_3.noarch
libvirt-9.5.0-7.el9_3.x86_64