netfilter: ipset: references are protected by rwlock instead of mutex