binder: fix use-after-free in shinker's callback