[PATCH] USB: Fix oops in usblp driver

This bug was reported back in July, and I sent out a patch but apparently
it never got to you.  The usblp driver was calling usb_buffer_free() from
usblp_cleanup(), which runs after disconnect() if a user process holds the
device open.  But once the usb_device is gone usb_buffer_free() will
oops.  The patch frees the buffers in usb_disconnect() instead.

Recently Joost Witteveen reported the same oops and found that the
patch solved it for him.  So there shouldn't be problems with accepting
it.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Vojtech Pavlik <vojtech@suse.cz>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

drivers/usb/class/usblp.c

@@ -397,10 +397,6 @@ static void usblp_cleanup (struct usblp *usblp)
 {
 	info("usblp%d: removed", usblp->minor);
 
-	usb_buffer_free (usblp->dev, USBLP_BUF_SIZE,
-			usblp->writebuf, usblp->writeurb->transfer_dma);
-	usb_buffer_free (usblp->dev, USBLP_BUF_SIZE,
-			usblp->readbuf, usblp->readurb->transfer_dma);
 	kfree (usblp->device_id_string);
 	kfree (usblp->statusbuf);
 	usb_free_urb(usblp->writeurb);
@@ -1159,6 +1155,10 @@ static void usblp_disconnect(struct usb_interface *intf)
 	usb_set_intfdata (intf, NULL);
 
 	usblp_unlink_urbs(usblp);
+	usb_buffer_free (usblp->dev, USBLP_BUF_SIZE,
+			usblp->writebuf, usblp->writeurb->transfer_dma);
+	usb_buffer_free (usblp->dev, USBLP_BUF_SIZE,
+			usblp->readbuf, usblp->readurb->transfer_dma);
 
 	if (!usblp->used)
 		usblp_cleanup (usblp);