net_sched: fix a use-after-free in tc_ctl_tfilter()