diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c
index 92c53d9e1c5c861b77bece7387d655229002c53b..7a7824d83f82a9d48a2ccec8765dca8c73f595b6 100644
--- a/src/qemu/qemu_cgroup.c
+++ b/src/qemu/qemu_cgroup.c
@@ -191,9 +191,10 @@ qemuSetupTPMCgroup(virDomainDefPtr def,
 }
 
 
-int qemuSetupHostUsbDeviceCgroup(virUSBDevicePtr dev ATTRIBUTE_UNUSED,
-                                 const char *path,
-                                 void *opaque)
+static int
+qemuSetupHostUsbDeviceCgroup(virUSBDevicePtr dev ATTRIBUTE_UNUSED,
+                             const char *path,
+                             void *opaque)
 {
     virDomainObjPtr vm = opaque;
     qemuDomainObjPrivatePtr priv = vm->privateData;
@@ -221,6 +222,7 @@ qemuSetupHostdevCGroup(virDomainObjPtr vm,
     int ret = -1;
     qemuDomainObjPrivatePtr priv = vm->privateData;
     virPCIDevicePtr pci = NULL;
+    virUSBDevicePtr usb = NULL;
     char *path = NULL;
 
     /* currently this only does something for PCI devices using vfio
@@ -263,6 +265,28 @@ qemuSetupHostdevCGroup(virDomainObjPtr vm,
                 }
             }
             break;
+
+        case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_USB:
+            /* NB: hostdev->missing wasn't previously checked in the
+             * case of hotplug, only when starting a domain. Now it is
+             * always checked, and the cgroup setup skipped if true.
+             */
+            if (dev->missing)
+                break;
+            if ((usb = virUSBDeviceNew(dev->source.subsys.u.usb.bus,
+                                       dev->source.subsys.u.usb.device,
+                                       NULL)) == NULL) {
+                goto cleanup;
+            }
+
+            /* oddly, qemuSetupHostUsbDeviceCgroup doesn't ever
+             * reference the usb object we just created
+             */
+            if (virUSBDeviceFileIterate(usb, qemuSetupHostUsbDeviceCgroup,
+                                        vm) < 0) {
+                goto cleanup;
+            }
+            break;
         default:
             break;
         }
@@ -271,6 +295,7 @@ qemuSetupHostdevCGroup(virDomainObjPtr vm,
     ret = 0;
 cleanup:
     virPCIDeviceFree(pci);
+    virUSBDeviceFree(usb);
     VIR_FREE(path);
     return ret;
 }
@@ -326,6 +351,9 @@ qemuTeardownHostdevCgroup(virDomainObjPtr vm,
                 }
             }
             break;
+        case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_USB:
+            /* nothing to tear down for USB */
+            break;
         default:
             break;
         }
@@ -545,33 +573,8 @@ int qemuSetupCgroup(virQEMUDriverPtr driver,
             goto cleanup;
 
         for (i = 0; i < vm->def->nhostdevs; i++) {
-            virDomainHostdevDefPtr hostdev = vm->def->hostdevs[i];
-            virUSBDevicePtr usb;
-
-            if (qemuSetupHostdevCGroup(vm, hostdev) < 0)
+            if (qemuSetupHostdevCGroup(vm, vm->def->hostdevs[i]) < 0)
                 goto cleanup;
-
-            /* NB: the code below here should be moved into
-             * qemuSetupHostdevCGroup()
-             */
-            if (hostdev->mode != VIR_DOMAIN_HOSTDEV_MODE_SUBSYS)
-                continue;
-            if (hostdev->source.subsys.type != VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_USB)
-                continue;
-            if (hostdev->missing)
-                continue;
-
-            if ((usb = virUSBDeviceNew(hostdev->source.subsys.u.usb.bus,
-                                       hostdev->source.subsys.u.usb.device,
-                                       NULL)) == NULL)
-                goto cleanup;
-
-            if (virUSBDeviceFileIterate(usb, qemuSetupHostUsbDeviceCgroup,
-                                        vm) < 0) {
-                virUSBDeviceFree(usb);
-                goto cleanup;
-            }
-            virUSBDeviceFree(usb);
         }
     }
 
diff --git a/src/qemu/qemu_cgroup.h b/src/qemu/qemu_cgroup.h
index f499cb6873966a0f9646d3c90a587d7251f558bf..5faa5f9528bda30981924d06dcd5f04196a6f777 100644
--- a/src/qemu/qemu_cgroup.h
+++ b/src/qemu/qemu_cgroup.h
@@ -33,9 +33,6 @@ int qemuSetupDiskCgroup(virDomainObjPtr vm,
                         virDomainDiskDefPtr disk);
 int qemuTeardownDiskCgroup(virDomainObjPtr vm,
                            virDomainDiskDefPtr disk);
-int qemuSetupHostUsbDeviceCgroup(virUSBDevicePtr dev,
-                                 const char *path,
-                                 void *opaque);
 int qemuSetupHostdevCGroup(virDomainObjPtr vm,
                            virDomainHostdevDefPtr dev)
    ATTRIBUTE_RETURN_CHECK;
diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
index 6beb2d6ee1ba754ec5ac2b6ffcd7e594ff9a085f..0d1ca4501642c47c889c279aa6cf199550797d6e 100644
--- a/src/qemu/qemu_hotplug.c
+++ b/src/qemu/qemu_hotplug.c
@@ -1151,22 +1151,6 @@ int qemuDomainAttachHostUsbDevice(virQEMUDriverPtr driver,
         goto error;
     }
 
-    if (virCgroupHasController(priv->cgroup, VIR_CGROUP_CONTROLLER_DEVICES)) {
-        virUSBDevicePtr usb;
-
-        if ((usb = virUSBDeviceNew(hostdev->source.subsys.u.usb.bus,
-                                hostdev->source.subsys.u.usb.device,
-                                NULL)) == NULL)
-            goto error;
-
-        if (virUSBDeviceFileIterate(usb, qemuSetupHostUsbDeviceCgroup,
-                                    vm) < 0) {
-            virUSBDeviceFree(usb);
-            goto error;
-        }
-        virUSBDeviceFree(usb);
-    }
-
     qemuDomainObjEnterMonitor(driver, vm);
     if (virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_DEVICE))
         ret = qemuMonitorAddDevice(priv->mon, devstr);