USB: fix use-after-free bug in usb_hcd_unlink_urb()