CVE-2026-46112 RDMA/hns: Fix unlocked call to hns_roce_qp_remove()