Thanks Matt and Phill for confirming the line that triggers the oops. As I 
am not able to reproduce it myself, it's a bit tricky to track down what 
went wrong.

Could you please apply the patch below? It's printing the hid <-> hiddev 
<-> usb_interface connections at various stages of probing and open. 
Hopefully it'll reveal a little bit what goes wrong and where.

Thanks.

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 3f72924..3159a63 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c

@@ -1155,6 +1155,8 @@ int hid_connect(struct hid_device *hdev, unsigned int connect_mask)
 	unsigned int i;
 	int len;
 
+	printk("HID debug: hid_connect() -- hid: %p\n", hdev);
+
 	if (hdev->quirks & HID_QUIRK_HIDDEV_FORCE)
 		connect_mask |= (HID_CONNECT_HIDDEV_FORCE | HID_CONNECT_HIDDEV);
 	if (hdev->quirks & HID_QUIRK_HIDINPUT_FORCE)

@@ -1169,8 +1171,11 @@ int hid_connect(struct hid_device *hdev, unsigned int connect_mask)
 		hdev->claimed |= HID_CLAIMED_INPUT;
 	if ((connect_mask & HID_CONNECT_HIDDEV) && hdev->hiddev_connect &&
 			!hdev->hiddev_connect(hdev,
-				connect_mask & HID_CONNECT_HIDDEV_FORCE))
+				connect_mask & HID_CONNECT_HIDDEV_FORCE)) {
 		hdev->claimed |= HID_CLAIMED_HIDDEV;
+		printk("HID debug: hid_connect() -- after hiddev_connect(), hid: %p, hiddev: %p\n",
+				hdev, hdev->hiddev);
+	}
 	if ((connect_mask & HID_CONNECT_HIDRAW) && !hidraw_connect(hdev))
 		hdev->claimed |= HID_CLAIMED_HIDRAW;
 

diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 599041a..d2491a1 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c

@@ -1148,6 +1148,7 @@ static int usbhid_probe(struct usb_interface *intf, const struct usb_device_id *
 	if (IS_ERR(hid))
 		return PTR_ERR(hid);
 
+	printk("HID debug: usbhid_probe() -- set intfdata(%p, %p)\n", intf, hid);
 	usb_set_intfdata(intf, hid);
 	hid->ll_driver = &usb_hid_driver;
 	hid->hid_output_raw_report = usbhid_output_raw_report;

diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index 681e620..9aab39a 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c

@@ -282,6 +282,8 @@ static int hiddev_open(struct inode *inode, struct file *file)
 	list->hiddev = hiddev;
 	file->private_data = list;
 
+	printk("HID debug: hiddev_open(): hid: %p, hiddev: %p, intf: %p\n",
+			hid, hiddev, intf);
 	/*
 	 * no need for locking because the USB major number
 	 * is shared which usbcore guards against disconnect

@@ -892,6 +894,8 @@ int hiddev_connect(struct hid_device *hid, unsigned int force)
 	hid->hiddev = hiddev;
 	hiddev->hid = hid;
 	hiddev->exist = 1;
+	printk("HID debug: hiddev_connect() -- hid: %p, hiddev: %p, intf: %p\n",
+			hid, hiddev, usbhid->intf);
 	retval = usb_register_dev(usbhid->intf, &hiddev_class);
 	if (retval) {
 		err_hid("Not able to get a minor for this device.");

@@ -912,6 +916,8 @@ void hiddev_disconnect(struct hid_device *hid)
 	struct hiddev *hiddev = hid->hiddev;
 	struct usbhid_device *usbhid = hid->driver_data;
 
+	printk("HID debug: hiddev_disconnect() -- hid: %p, usbhid: %p, hiddev: %p\n",
+			hid, usbhid, hiddev);
 	mutex_lock(&hiddev->existancelock);
 	hiddev->exist = 0;
 	mutex_unlock(&hiddev->existancelock);