kernfs: fix use-after-free in __kernfs_remove