perf AddrFilter UAF

Vulnerability analysis

The perf events subsystem stores address filter range data that is read under RCU protection, but the original code freed this data with a plain deallocation in the event teardown path before the RCU grace period elapsed. This means another thread performing an RCU-protected read could still be accessing the filter ranges when the memory is freed, resulting in a use-after-free. The fix moves the deallocation into the RCU callback that runs after the grace period, ensuring all readers have completed before the memory is released. This is reachable from local userspace through the perf events interface; unprivileged users can access perf events for self-monitoring depending on the system's perf_event_paranoid setting, and the race occurs during event destruction.