diff --git a/net/sched/cls_cgroup.c b/net/sched/cls_cgroup.c
index 0d68b1975983a323775b5c4deef4f2ae1ae8ae5d..31d95b1946c6ab27a681b0fe90b5869d16e1e65a 100644
--- a/net/sched/cls_cgroup.c
+++ b/net/sched/cls_cgroup.c
@@ -46,7 +46,7 @@ static struct cgroup_subsys_state *cgrp_create(struct cgroup_subsys *ss,
 
 static void cgrp_destroy(struct cgroup_subsys *ss, struct cgroup *cgrp)
 {
-	kfree(ss);
+	kfree(net_cls_state(cgrp));
 }
 
 static u64 read_classid(struct cgroup *cgrp, struct cftype *cft)