media: usb: npu-acm: Fix incorrect usb_kill_urb in disconnect

When disconnecting npu_acm the kernel sporadically crashes shortly
after the disconnect:

[10169.869140] usb 5-1: USB disconnect, device number 43
[10169.879860] Unable to handle kernel paging request at virtual address 000100dd
[10169.880535] pgd = ffffff8009586000
[10169.880853] [000100dd] *pgd=00000000f6ffe003, *pud=00000000f6ffe003, *pmd=0000000000000000
[10169.881627] Internal error: Oops: 96000005 [#1] PREEMPT SMP
[10169.882130] Modules linked in: midgard_kbase
[10169.882563] CPU: 0 PID: 191 Comm: kworker/0:2 Not tainted 4.4.189 #7
[10169.883134] Hardware name: Rockchip RK3399pro evb v13 multi camera board (DT)
[10169.883801] Workqueue: usb_hub_wq hub_event
[10169.884193] task: ffffffc0f0fb4380 task.stack: ffffffc0f0eb4000
[10169.884739] PC is at kobject_get+0x14/0x80
[10169.885124] LR is at get_device+0x14/0x24
[10169.885490] pc : [<ffffff80083b0b00>] lr : [<ffffff800850ea20>] pstate: 204001c5
...
Call trace:
[10170.017534] [<ffffff80083b0b00>] kobject_get+0x14/0x80
[10170.018012] [<ffffff800850ea20>] get_device+0x14/0x24
[10170.018483] [<ffffff80085b9e90>] usb_get_dev+0x1c/0x2c
[10170.018959] [<ffffff80085c2ae0>] usb_hcd_unlink_urb+0x4c/0xac
[10170.019481] [<ffffff80085c39e0>] usb_kill_urb+0x60/0xe8
[10170.019962] [<ffffff8008704520>] npu_acm_disconnect+0x194/0x198
[10170.020509] [<ffffff80085c77a0>] usb_unbind_interface+0x94/0x1d8
[10170.021058] [<ffffff800851315c>] __device_release_driver+0x80/0xf0
[10170.021623] [<ffffff80085131f0>] device_release_driver+0x24/0x38
[10170.022165] [<ffffff80085123b0>] bus_remove_device+0xc4/0xf8
[10170.022686] [<ffffff800850f8dc>] device_del+0x140/0x204
[10170.023173] [<ffffff80085c55e8>] usb_disable_device+0x158/0x200
[10170.023715] [<ffffff80085bd7d0>] usb_disconnect+0x80/0x1b4
[10170.024211] [<ffffff80085beee4>] hub_event+0x558/0xdfc
[10170.024693] [<ffffff80080b8930>] process_one_work+0x1bc/0x3c0
[10170.025215] [<ffffff80080b986c>] worker_thread+0x2d8/0x398
[10170.025715] [<ffffff80080be214>] kthread+0xe8/0xf8
[10170.026156] [<ffffff80080832a0>] ret_from_fork+0x10/0x30

The problem was caused by incorrect operation usb_kill_urb in disconnect.
So we remove redundant usb_kill_urb() in acm_port_shutdown(), and let the
acm_port_shutdown() operation before usb_kill_urb().

Change-Id: I49d241918466e69889c5f7117f2571737b3699d2
Signed-off-by: Bin Yang <yangbin@rock-chips.com>

drivers/media/usb/rockchip/npu-acm.c

@@ -459,7 +459,6 @@ static void acm_port_shutdown(struct acm *acm)
 {
 	struct urb *urb;
 	struct acm_wb *wb;
-	int i;
 
 	dev_dbg(&acm->control->dev, "%s\n", __func__);
 
@@ -482,12 +481,6 @@ static void acm_port_shutdown(struct acm *acm)
 		wb->use = 0;
 		usb_autopm_put_interface_async(acm->control);
 	}
-
-	usb_kill_urb(acm->ctrlurb);
-	for (i = 0; i < ACM_NW; i++)
-		usb_kill_urb(acm->wb[i].urb);
-	for (i = 0; i < acm->rx_buflimit; i++)
-		usb_kill_urb(acm->read_urbs[i]);
 }
 
 static int acm_write(struct acm *acm, const unsigned char *buf, int count)
@@ -1026,6 +1019,7 @@ static void npu_acm_disconnect(struct usb_interface *intf)
 	usb_set_intfdata(acm->data, NULL);
 	mutex_unlock(&acm->mutex);
 
+	acm_port_shutdown(acm);
 	stop_data_traffic(acm);
 
 	usb_free_urb(acm->ctrlurb);
@@ -1041,7 +1035,6 @@ static void npu_acm_disconnect(struct usb_interface *intf)
 	usb_driver_release_interface(&npu_acm_driver,
 				     intf == acm->control ?
 				     acm->data : acm->control);
-	acm_port_shutdown(acm);
 }
 
 #ifdef CONFIG_PM