epoll: fix race between ep_poll_callback(POLLFREE) and ep_free()/ep_remove()