netfilter: ipset: References are protected by rwlock instead of mutex