net/tun: Do not DecRef a closed TUN endpoint when un-persisting it.

This requires coordinating tunEndpoint.closed and tunEndpoint.persistent.
Earlier these were independent atomic bools. This change moves them under
the protection of tunEndpoint.mu.

Fixes 81d7f66 ("netstack/tuntap: implement the TUNSETPERSIST ioctl")

Reported-by: syzbot+e18c12f830349b415fdb@syzkaller.appspotmail.com
PiperOrigin-RevId: 807748254

Author: ayushr2

pkg/tcpip/link/tun/device.go

@@ -17,7 +17,6 @@ package tun
 import (
 	"fmt"
 
-	"gvisor.dev/gvisor/pkg/atomicbitops"
 	"gvisor.dev/gvisor/pkg/buffer"
 	"gvisor.dev/gvisor/pkg/context"
 	"gvisor.dev/gvisor/pkg/errors/linuxerr"
@@ -362,22 +361,26 @@ type tunEndpoint struct {
 	tunEndpointRefs
 	*channel.Endpoint
 
-	stack      *stack.Stack
-	nicID      tcpip.NICID
-	name       string
-	isTap      bool
-	persistent atomicbitops.Bool
-	closed     atomicbitops.Bool
+	stack *stack.Stack
+	nicID tcpip.NICID
+	name  string
+	isTap bool
 
 	mu            endpointMutex `state:"nosave"`
 	onCloseAction func()        `state:"nosave"`
+	persistent    bool
+	closed        bool
 }
 
 func (e *tunEndpoint) setPersistent(v bool) {
-	old := e.persistent.Swap(v)
-	if old == v {
+	e.mu.Lock()
+	if e.persistent == v || e.closed {
+		e.mu.Unlock()
 		return
 	}
+	e.persistent = v
+	e.mu.Unlock()
+	// Update refs without holding the lock.
 	if v {
 		e.IncRef()
 	} else {
@@ -386,17 +389,19 @@ func (e *tunEndpoint) setPersistent(v bool) {
 }
 
 func (e *tunEndpoint) Close() {
-	if e.closed.Swap(true) {
+	e.mu.Lock()
+	if e.closed {
+		e.mu.Unlock()
 		return
 	}
-
-	if e.persistent.Load() {
-		e.DecRef(context.Background())
-	}
-	e.mu.Lock()
+	e.closed = true
+	decref := e.persistent
 	action := e.onCloseAction
 	e.onCloseAction = nil
 	e.mu.Unlock()
+	if decref {
+		e.DecRef(context.Background())
+	}
 	if action != nil {
 		action()
 	}