This bug was reported back in July, and I sent out a patch but apparently
it never got to you.  The usblp driver was calling usb_buffer_free() from
usblp_cleanup(), which runs after disconnect() if a user process holds the
device open.  But once the usb_device is gone usb_buffer_free() will
oops.  The patch frees the buffers in usb_disconnect() instead.

Recently Joost Witteveen reported the same oops and found that the
patch solved it for him.  So there shouldn't be problems with accepting
it.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Vojtech Pavlik <vojtech@suse.cz>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>