mm: memcg/slab: fix panic in __free_slab() caused by premature memcg pointer release