cgroup: duplicate cgroup reference when cloning sockets