Steps to reproduce
1.Boot VM

/usr/libexec/qemu-kvm \
     -S  \
     -name 'avocado-vt-vm1'  \
     -sandbox on \
     -machine q35 \
     -device pcie-root-port,id=pcie-root-port-0,multifunction=on,bus=pcie.0,addr=0x1,chassis=1 \
     -device pcie-pci-bridge,id=pcie-pci-bridge-0,addr=0x0,bus=pcie-root-port-0  \
     -nodefaults \
     -device VGA,bus=pcie.0,addr=0x2 \
     -m 6144  \
     -smp 6,maxcpus=6,cores=3,threads=1,sockets=2  \
     -cpu 'Haswell-noTSX-IBRS',vme=on,ss=on,vmx=on,f16c=on,rdrand=on,hypervisor=on,arat=on,tsc-adjust=on,umip=on,md-clear=on,stibp=on,arch-capabilities=on,ssbd=on,xsaveopt=on,pdpe1gb=on,abm=on,ibpb=on,skip-l1dfl-vmentry=on,kvm_pv_unhalt=on \
 \
     -device pcie-root-port,id=pcie-root-port-1,port=0x1,addr=0x1.0x1,bus=pcie.0,chassis=2 \
     -device qemu-xhci,id=usb1,bus=pcie-root-port-1,addr=0x0 \
     -device usb-tablet,id=usb-tablet1,bus=usb1.0,port=1 \
     -object iothread,id=iothread0 \
     -object iothread,id=iothread1 \
     -device pcie-root-port,id=pcie-root-port-2,port=0x2,addr=0x1.0x2,bus=pcie.0,chassis=3 \
     -device virtio-scsi-pci,id=virtio_scsi_pci0,bus=pcie-root-port-2,addr=0x0,iothread=iothread0 \
     -drive id=drive_image1,if=none,snapshot=off,readonly=off,aio=threads,cache=none,format=qcow2,file=/home/kvm_autotest_root/images/rhel940-64-virtio-scsi.qcow2 \
     -device scsi-hd,id=image1,drive=drive_image1 \
     -device pcie-root-port,id=pcie-root-port-3,port=0x3,addr=0x1.0x3,bus=pcie.0,chassis=4 \
     -device virtio-net-pci,mac=9a:26:ed:ca:72:32,id=id1txQVn,netdev=id4DObfw,bus=pcie-root-port-3,addr=0x0 \
     -netdev tap,id=id4DObfw,vhost=on,vhostfd=18,fd=15  \
     -vnc :0  \
     -rtc base=utc,clock=host,driftfix=slew  \
     -boot menu=off,order=cdn,once=c,strict=off \
     -enable-kvm \
     -device pcie-root-port,id=pcie_extra_root_port_0,multifunction=on,bus=pcie.0,addr=0x3,chassis=5

2.hotplug disk
drive_add auto id=drive_stg0,if=none,snapshot=off,readonly=off,aio=threads,cache=none,format=qcow2,file=/home/kvm_autotest_root/images/storage0.qcow2
{"execute": "device_add", "arguments": {"driver": "scsi-hd", "id": "stg0", "drive": "drive_stg0", "bus": "virtio_scsi_pci0.0"}, "id": "qNtzV8oW"}

3.format the new disk
dd if=/dev/zero of=/dev/sdb bs=1M count=64 oflag=direct && sleep 1; partprobe /dev/sdb
parted -s "/dev/sdb" mklabel msdos
parted -s "/dev/sdb" mkpart primary 0M 15360.0M
partprobe /dev/sdb
yes|mkfs.ext4 -F '/dev/sdb1'
rm -rf /mnt/sdb1; mkdir /mnt/sdb1
mount -t ext4 /dev/sdb1 /mnt/sdb1

4.execute io on disk
/home/iozone_inst/src/current/iozone -az -g 10G -y 32k -i 0 -i 1 -I -f /mnt/sdb1/iozone_test

5.unplug disk
{"execute": "device_del", "arguments": {"id": "stg0"}, "id": "jBVHXCyW"}

6. umount disk
mount|grep sdb ; umount /mnt/sdb1 && sleep 3 

7. repeat step2-6 60 times

Expected results
login guest succeed after above steps

Actual results
qemu crash
  
(not hit crash issue on rhel8.4 /8.6/8.8)