binder: binder: fix possible UAF when freeing buffer

There is a race between the binder driver cleaning
up a completed transaction via binder_free_transaction()
and a user calling binder_ioctl(BC_FREE_BUFFER) to
release a buffer. It doesn't matter which is first but
they need to be protected against running concurrently
which can result in a UAF.

Bug: 133758011
Change-Id: Ie1426ff3d00218d050d61ff77b333ddf8818b7c9
Signed-off-by: Todd Kjos <tkjos@google.com>
Git-commit: 0e1b964ab45ea74a54c988228c777d3b701c265f
Git-repo: https://android.googlesource.com/kernel/common/


Signed-off-by: Rahul Shahare <rshaha@codeaurora.org>
Signed-off-by: Naitik Bharadiya <bharad@codeaurora.org>
Signed-off-by: Anurag Chouhan <achouhan@codeaurora.org>