cgroup: always use RCU accessors for protected accesses