Bug 1786414

It could be reproduced on rhel8.2-av:
libvirt-5.10.0-1.module+el8.2.0+5135+ed3b2489.x86_64
qemu-kvm-4.2.0-4.module+el8.2.0+5220+e82621dc.x86_64

+++ This bug was initially created as a clone of Bug #1786413 +++

Description of problem:
As subject

Version-Release number of selected component (if applicable):
Desktop:virt-viewer-7.0-9.el8.x86_64 spice-glib-0.37-1.el8.x86_64
Hosts: qemu-kvm-4.1.0-20.module+el8.1.1+5309+6d656f05.x86_64
libvirt-5.6.0-10.module+el8.1.1+5309+6d656f05.x86_64

How reproducible:
50%

Steps to Reproduce:
1. Prepare a vm on an virt host. Prepare migration for two hosts.
Replace the SRC and DST host for migration in migrate.sh. Replace SPICE_SERVER with your spice console url of your vm. Prepare an USB device on your desktop.
Prepare to gather coredump and log:
# cat /etc/libvirt/qemu.conf
gluster_debug_level = 0
max_core = "unlimited"

# tail /etc/libvirt/libvirtd.conf
log_level = 3
log_filters = "1:qemu 1:libvirt"
log_outputs = "1:file:/var/log/libvirt/libvirtd.log"

Then restart libvirtd.


2. Run ./migrate.sh to start migration loop. Run run.sh to start remote-viewer connnects

3. When remote-viewer has connected the vm, click File --> USB device selection --> select your desktop usb device to enable usbredir. 
Continue above in step3 until the vm crashes.

Guest log of crash:
qemu-kvm: hw/usb/core.c:408: usb_handle_packet: Assertion `dev->state == USB_STATE_DEFAULT' failed.
2019-12-25 03:33:00.117+0000: shutting down, reason=crashed


Core backtrace:
#0  0x00007f57712ce8df in raise () from /lib64/libc.so.6
#1  0x00007f57712b8cf5 in abort () from /lib64/libc.so.6
#2  0x00007f57712b8bc9 in __assert_fail_base.cold.0 () from /lib64/libc.so.6
#3  0x00007f57712c6e96 in __assert_fail () from /lib64/libc.so.6
#4  0x000055a9ba0faf5d in usb_handle_packet (dev=0x55a9bd298ac0, p=p@entry=0x7f5738018948) at hw/usb/core.c:408                                                            
#5  0x000055a9ba10939c in xhci_submit (epctx=<optimized out>, xfer=<optimized out>, xhci=<optimized out>) at hw/usb/hcd-xhci.c:1826                                        
#6  xhci_fire_transfer (epctx=<optimized out>, xfer=<optimized out>, xhci=<optimized out>) at hw/usb/hcd-xhci.c:1835                                                       
#7  xhci_kick_epctx (epctx=0x55a9bcb5ad40, streamid=0) at hw/usb/hcd-xhci.c:1986
#8  0x000055a9b9f4ab13 in memory_region_write_accessor (mr=<optimized out>, addr=<optimized out>, value=<optimized out>, size=<optimized out>, shift=<optimized out>,      
    mask=<optimized out>, attrs=...) at /usr/src/debug/qemu-kvm-4.1.0-20.module+el8.1.1+5309+6d656f05.x86_64/memory.c:507                                                  
#9  0x000055a9b9f48d26 in access_with_adjusted_size (addr=addr@entry=4, value=value@entry=0x7f574e12f558, size=size@entry=4, access_size_min=<optimized out>,              
    access_size_max=<optimized out>, access_fn=access_fn@entry=0x55a9b9f4aac0 <memory_region_write_accessor>, mr=0x7f574d338d70, attrs=...)                                
    at /usr/src/debug/qemu-kvm-4.1.0-20.module+el8.1.1+5309+6d656f05.x86_64/memory.c:573                                                                                   
#10 0x000055a9b9f4cd00 in memory_region_dispatch_write (mr=0x7f574d338d70, addr=4, data=<optimized out>, size=4, attrs=...)                                                
    at /usr/src/debug/qemu-kvm-4.1.0-20.module+el8.1.1+5309+6d656f05.x86_64/memory.c:1509                                                                                  
#11 0x000055a9b9ef9ca3 in flatview_write_continue (fv=0x55a9bd28f6e0, addr=4238352388, attrs=...,                                                                          
    buf=0x7f5776d09028 <error: Cannot access memory at address 0x7f5776d09028>, len=4, addr1=<optimized out>, l=<optimized out>, mr=0x7f574d338d70)                        
    at /usr/src/debug/qemu-kvm-4.1.0-20.module+el8.1.1+5309+6d656f05.x86_64/exec.c:3369                                                                                    
#12 0x000055a9b9ef9ec6 in flatview_write (fv=0x55a9bd28f6e0, addr=4238352388, attrs=..., buf=0x7f5776d09028 <error: Cannot access memory at address 0x7f5776d09028>, len=4)
    at /usr/src/debug/qemu-kvm-4.1.0-20.module+el8.1.1+5309+6d656f05.x86_64/exec.c:3408                                                                                    
#13 0x000055a9b9efe25a in address_space_write (as=<optimized out>, addr=<optimized out>, attrs=..., buf=<optimized out>, len=<optimized out>)                              
    at /usr/src/debug/qemu-kvm-4.1.0-20.module+el8.1.1+5309+6d656f05.x86_64/exec.c:3498                                                                                    
#14 0x000055a9b9f5b9ba in kvm_cpu_exec (cpu=<optimized out>) at /usr/src/debug/qemu-kvm-4.1.0-20.module+el8.1.1+5309+6d656f05.x86_64/accel/kvm/kvm-all.c:2316              
#15 0x000055a9b9f409fe in qemu_kvm_cpu_thread_fn (arg=0x55a9bbeb55e0) at /usr/src/debug/qemu-kvm-4.1.0-20.module+el8.1.1+5309+6d656f05.x86_64/cpus.c:1285                  
#16 0x000055a9ba262954 in qemu_thread_start (args=0x55a9bbed9030) at util/qemu-thread-posix.c:502                                                                          
#17 0x00007f57716622de in start_thread () from /lib64/libpthread.so.0
#18 0x00007f5771393133 in clone () from /lib64/libc.so.6


Actual results:
As subject

Expected results:
NO crash

Additional info:
Logs in attachment:
host1-qemu.log: qemu guest log of host1 
host2-qemu.log: qemu guest log of host2
viewer.log: remote-viewer debug log
gdb.txt: full threads backtrace
host1-libvirtd.log: libvirtd log of host1
host2-libvirtd.log: libvirtd log of host2