[stable] binder: fix race between munmap() and direct reclaim