netfilter: use rcu_dereference_protected()