ANDROID: binder: synchronize_rcu() when using POLLFREE.

commit 5eeb2ca0 upstream.

To prevent races with ep_remove_waitqueue() removing the
waitqueue at the same time.

Change-Id: I6c7528260aaca7d1015eefad1802c6104aa371e3
Reported-by:  <syzbot+a2a3c4909716e271487e@syzkaller.appspotmail.com>
Signed-off-by: Martijn Coenen <maco@android.com>
Cc: stable <stable@vger.kernel.org> # 4.14+
Signed-off-by: Mattias Nissler <mnissler@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>