运行后错误为ResultSet is closed，求助

问题描述：HTTP Status 500 - org.apache.jasper.JasperException:
javax.servlet.ServletException: java.sql.SQLException: java.sql.SQLException:[color=#FF0000] ResultSet is closed[/color]
代码如下（userDao.java）类：
package dao;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.SQLException;
import java.sql.Statement;
import java.sql.ResultSet;
import java.util.ArrayList;
import vo.user;
public class userDao {
//访问数据库
private Connection conn = null;
ArrayList users=new ArrayList();
user us=null;
public user queryAllUser(String username) throws Exception {
try
{
Class.forName("sun.jdbc.odbc.JdbcOdbcDriver");
conn = DriverManager.getConnection("jdbc:odbc:D");
String sql ="SELECT * FROM tb_Member where username='"+username+"'";
Statement stat=conn.createStatement();
ResultSet rs = stat.executeQuery(sql);
while (rs.next()) {
us = new user();
us.setUsername(rs.getString(1));
us.setPassword(rs.getString(3));
return us;
}
stat.close();
rs.close();
}catch(SQLException e){
e.printStackTrace();
}finally{
try{
if(conn!=null){
conn.close();
conn=null;
}
}catch(Exception ex){
}
}
return us;
}}
vo包里的user.java类：
package vo;
public class user {
private String username;
private String password;
public String getUsername() {
return username;
}
public void setUsername(String username) {
this.username = username;
}
public String getPassword() {
return password;
}
public void setPassword(String password) {
this.password = password;
}
}
最重要的登录需要提交的jsp页面代码：
<%@ page language="java" import="java.util.*" import="java.sql.*" pageEncoding="gb2312"%>
<%@ page import="vo.user,dao.userDao"%>
<%
request.setCharacterEncoding("gb2312");
String username=request.getParameter("username");
String password=request.getParameter("PWD");
if(username!=null&&password!=null){
userDao userdao=new userDao();
user us=userdao.queryAllUser(username);
try{
if(us==null){
out.println("输入错误，该用户名不存在 ");
}else{
out.println("密码输入错误");
if(password.equals(us.getPassword())){
A句：session.setAttribute("UserName",username);(本句有错，但是我需要这一句，因为我要保存UserName，下一个页面要用的)
                //B句session.setAttribute("password",password);//若是注销A句，执行B句是可以运行的。请大家帮我看看到底怎么回事，我已经思考了好几天了也没想出来[大哭]
                response.sendRedirect("index.jsp");
            }
        }
    }catch(Exception e){
       e.printStackTrace();
    }
}
%>