binder: fix yet another UAF in binder_devices

In the Linux kernel, the following vulnerability has been resolved:

binder: fix yet another UAF in binder_devices

Commit e77aff5528a18 ("binderfs: fix use-after-free in binder_devices")

addressed a use-after-free where devices could be released without first

being removed from the binder_devices list. However, there is a similar

path in binder_free_proc() that was missed:

==================================================================

BUG: KASAN: slab-use-after-free in binder_remove_device+0xd4/0x100

Write of size 8 at addr ffff0000c773b900 by task umount/467

CPU: 12 UID: 0 PID: 467 Comm: umount Not tainted 6.15.0-rc7-00138-g57483a362741 #9 PREEMPT

Hardware name: linux,dummy-virt (DT)

Call trace:

binder_remove_device+0xd4/0x100

binderfs_evict_inode+0x230/0x2f0

evict+0x25c/0x5dc

iput+0x304/0x480

dentry_unlink_inode+0x208/0x46c

__dentry_kill+0x154/0x530

[...]

Allocated by task 463:

__kmalloc_cache_noprof+0x13c/0x324

binderfs_binder_device_create.isra.0+0x138/0xa60

binder_ctl_ioctl+0x1ac/0x230

[...]

Freed by task 215:

kfree+0x184/0x31c

binder_proc_dec_tmpref+0x33c/0x4ac

binder_deferred_func+0xc10/0x1108

process_one_work+0x520/0xba4

[...]

==================================================================

Call binder_remove_device() within binder_free_proc() to ensure the

device is removed from the binder_devices list before being kfreed.