Description of problem:
qemu core dump when continuouly hotplug/unplug virtserialport and virito-serial-pci in a loop

Version-Release number of selected component (if applicable):
kernel-3.10.0-666.el7.x86_64
qemu-kvm-rhev-2.9.0-6.el7.x86_64
virtio-win-prewhql-137

How reproducible:
100%

Steps to Reproduce:
1.Start a VM:
/usr/libexec/qemu-kvm \
-name win2008 \
-enable-kvm -m 3G -smp 4 -cpu SandyBridge -uuid ea78071a-f6e4-4347-8077-9cb9f7953a84 \
-nodefconfig --nodefaults -boot order=cd,menu=on \
-device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 -chardev pty,id=charserial0 -device isa-serial,chardev=charserial0,id=isa_serial0 -device usb-tablet,id=input0 \
-drive file=2008-32.raw,if=none,id=drive-ide0-0-1,format=raw,serial=mike_cao,cache=none -device ide-drive,bus=ide.0,unit=1,drive=drive-ide0-0-1,id=ide0-0-1 \
-drive file=/home/function_7.4/balloon/en_windows_server_2008_datacenter_enterprise_standard_sp2_x86_dvd_342333.iso,media=cdrom,id=cdrom,if=none -device ide-drive,drive=cdrom,bootindex=1 \
-netdev tap,id=hostnet0,vhost=on,vhostforce=off \
-device virtio-net-pci,netdev=hostnet0,id=net0,mac=52:83:66:77:88:66,bus=pci.0,addr=0x3,status=on \
-vnc 0.0.0.0:1 -vga std -monitor stdio -qmp tcp:0:4446,server,nowait \
-cdrom /home/virtio-win-prewhql-137.iso \
-device virtio-serial-pci,id=virtio-serial0,max_ports=511 -chardev socket,id=channel1,path=/tmp/helloworld1,server,nowait -device virtserialport,chardev=channel1,name=com.redhat.rhevm.vdsm1,bus=virtio-serial0.0,id=port1 -chardev socket,id=channel2,path=/tmp/helloworld2,server,nowait -device virtserialport,chardev=channel2,name=com.redhat.rhevm.vdsm2,bus=virtio-serial0.0,id=port2

2. In the host, continuous hotplug/unplug virtserialport and virito-serial-pci in a loop. the loop script as follows:
#!/bin/bash
# some simply scripts for balloon device hotplug/unplug in a loop
let i=0
exec 3<>/dev/tcp/localhost/4446 #note modify this to qmp port
echo -e "{ 'execute': 'qmp_capabilities' }" >&3
read response <&3
echo $response
while [ $i -lt 100 ]
do
echo -e "{ 'execute': 'device_del', 'arguments': {'id': 'port1' }}">&3 ;
sleep 3 ;
read response <&3 ;
echo "$i: $response"
echo -e "{ 'execute': 'device_del', 'arguments': {'id': 'port2' }}">&3 ;
sleep 3 ;
read response <&3 ;
echo "$i: $response"
echo -e "{'execute':'device_del','arguments':{'id':'virtio-serial0'}}">&3;
sleep 3 ;
read response <&3 ;
echo "$i: $response"
echo -e "{'execute':'device_add','arguments':{'driver':'virtio-serial-pci','id':'virtio-serial0','max_ports':511}}">&3;
sleep 3;
read response <&3;
echo "$i: $response"
echo -e "{'execute':'device_add','arguments':{'driver':'virtserialport','chardev':'channel1','name':'com.redhat.rhevm.vdsm1','bus':'virtio-serial0.0','id':'port1'}}">&3 ;
sleep 3 ;
read response <&3;
echo "$i: $response"
echo -e "{'execute':'device_add','arguments':{'driver':'virtserialport','chardev':'channel2','name':'com.redhat.rhevm.vdsm2','bus':'virtio-serial0.0','id':'port2'}}">&3 ;
sleep 3 ;
read response <&3
echo "$i: $response"
let i=$i+1
done

3. Check the host qemu monitor.

Actual results:
core dump

Expected results:
Pass

Additional info:
1. Reproduced this bug with qemu-kvm-rhev-2.9.0-6 +virtio-win-prewhql-126.
2. Cannot reproduce this bug with qemu-kvm-rhev-2.8.0-6 +virtio-win-prewhql-137.