diff --git a/[refs] b/[refs]
index 0b74ba865456..e303b01bf0b1 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 9ed8a659703876a9fe96ab86d1b296c2f0084242
+refs/heads/master: 71b5707e119653039e6e95213f00479668c79b75
diff --git a/trunk/kernel/cgroup.c b/trunk/kernel/cgroup.c
index 800852282c21..5d4c92ead691 100644
--- a/trunk/kernel/cgroup.c
+++ b/trunk/kernel/cgroup.c
@@ -422,12 +422,20 @@ static void __put_css_set(struct css_set *cg, int taskexit)
 		struct cgroup *cgrp = link->cgrp;
 		list_del(&link->cg_link_list);
 		list_del(&link->cgrp_link_list);
+
+		/*
+		 * We may not be holding cgroup_mutex, and if cgrp->count is
+		 * dropped to 0 the cgroup can be destroyed at any time, hence
+		 * rcu_read_lock is used to keep it alive.
+		 */
+		rcu_read_lock();
 		if (atomic_dec_and_test(&cgrp->count) &&
 		    notify_on_release(cgrp)) {
 			if (taskexit)
 				set_bit(CGRP_RELEASABLE, &cgrp->flags);
 			check_for_release(cgrp);
 		}
+		rcu_read_unlock();
 
 		kfree(link);
 	}