Escalated to Bugzilla from IssueTracker
Peter asked me to look at this ASAP, so I was in a hurry and misunderstood what was happening. I take back comparisons with bug 120341. What actually happened initially seems more similar to bug 129265: an oops while reading /proc/bus/usb/devices and disconnecting in the same time. The fix attached there should apply and help with this one. I do not know though. "Fix" that Neil produced for .wibu was pure pampering over the problem, and it a small surprise that usb-ohci collapsed. It's a very long and torturous explanation, but the outcome is that while strictly speaking it's legal, but in reality struct usb_device must not be freed from OHCI interrupts. Usually it's no problem, because client drivers hold dev references and drop them in ->disconnect methods. Chris left no trace whatsoever regarding what he fixed in usbutils and how that was supposed to work. I'm going to ping him and extract details. Neil, since you made a kernel for them, would you mind replacing the NULL check with my fix from bug 129265 and have the customer try it again (without any userland changes)? Chances are there won't be any freeing from interrupt then. The .wibu had no serial minor, so it should be "2.4.21-27.ELwibw" now to be the next release :-)
A fix for this problem has just been committed to the RHEL3 U7 patch pool this evening (in kernel version 2.4.21-37.3.EL).
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2006-0144.html