diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index c1e1a5c34e77..285683b7ee1a 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -5527,6 +5527,8 @@ static void css_killed_ref_fn(struct percpu_ref *ref)
  */
 static void kill_css(struct cgroup_subsys_state *css)
 {
+	struct cgroup_subsys_state *_css = css;
+
 	lockdep_assert_held(&cgroup_mutex);
 
 	if (css->flags & CSS_DYING)
@@ -5541,10 +5543,13 @@ static void kill_css(struct cgroup_subsys_state *css)
 	css_clear_dir(css);
 
 	/*
-	 * Killing would put the base ref, but we need to keep it alive
-	 * until after ->css_offline().
+	 * Killing would put the base ref, but we need to keep it alive,
+	 * and all the parents, until after ->css_offline().
 	 */
-	css_get(css);
+	do {
+		css_get(_css);
+		_css = _css->parent;
+	} while (_css && atomic_read(&_css->online_cnt));
 
 	/*
 	 * cgroup core guarantees that, by the time ->css_offline() is