Fix reference leaks

PiperOrigin-RevId: 494027351

pkg/refs/refs_map.go

@@ -145,7 +145,11 @@ type leakCheckDisabled interface {
 	LeakCheckDisabled() bool
 }
 
+// CleanupSync is used to wait for async cleanup actions.
+var CleanupSync sync.WaitGroup
+
 func doLeakCheck() {
+	CleanupSync.Wait()
 	liveObjectsMu.Lock()
 	defer liveObjectsMu.Unlock()
 	leaked := len(liveObjects)

pkg/sentry/socket/netstack/BUILD

@@ -26,6 +26,7 @@ go_library(
         "//pkg/marshal",
         "//pkg/marshal/primitive",
         "//pkg/metric",
+        "//pkg/refs",
         "//pkg/sentry/arch",
         "//pkg/sentry/device",
         "//pkg/sentry/fsimpl/sockfs",

pkg/sentry/socket/netstack/stack.go

@@ -21,6 +21,7 @@ import (
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/log"
+	"gvisor.dev/gvisor/pkg/refs"
 	"gvisor.dev/gvisor/pkg/sentry/inet"
 	"gvisor.dev/gvisor/pkg/syserr"
 	"gvisor.dev/gvisor/pkg/tcpip"
@@ -41,6 +42,11 @@ type Stack struct {
 // Destroy implements inet.Stack.Destroy.
 func (s *Stack) Destroy() {
 	s.Stack.Close()
+	refs.CleanupSync.Add(1)
+	go func() {
+		s.Stack.Wait()
+		refs.CleanupSync.Done()
+	}()
 }
 
 // SupportsIPv6 implements Stack.SupportsIPv6.

pkg/tcpip/link/sharedmem/sharedmem.go

@@ -259,6 +259,10 @@ func (e *endpoint) Wait() {
 // Attach implements stack.LinkEndpoint.Attach. It launches the goroutine that
 // reads packets from the rx queue.
 func (e *endpoint) Attach(dispatcher stack.NetworkDispatcher) {
+	if dispatcher == nil {
+		e.Close()
+		return
+	}
 	e.mu.Lock()
 	if !e.workerStarted && e.stopRequested.Load() == 0 {
 		e.workerStarted = true

pkg/tcpip/network/ip_test.go

@@ -637,6 +637,7 @@ func TestIPv4Send(t *testing.T) {
 	if err != nil {
 		t.Fatalf("could not find route: %v", err)
 	}
+	defer r.Release()
 	if err := ep.WritePacket(r, stack.NetworkHeaderParams{
 		Protocol: 123,
 		TTL:      123,
@@ -1091,6 +1092,7 @@ func TestIPv6Send(t *testing.T) {
 	if err != nil {
 		t.Fatalf("could not find route: %v", err)
 	}
+	defer r.Release()
 	if err := ep.WritePacket(r, stack.NetworkHeaderParams{
 		Protocol: 123,
 		TTL:      123,

pkg/tcpip/network/ipv4/ipv4_test.go

@@ -2117,6 +2117,7 @@ func TestFragmentationWritePacket(t *testing.T) {
 			ep := iptestutil.NewMockLinkEndpoint(ft.mtu, nil, math.MaxInt32)
 			defer ep.Close()
 			r := buildRoute(t, ctx, ep)
+			defer r.Release()
 			pkt := iptestutil.MakeRandPkt(ft.transportHeaderLength, extraHeaderReserve+header.IPv4MinimumSize, []int{ft.payloadSize}, header.IPv4ProtocolNumber)
 			defer pkt.DecRef()
 			source := pkt.Clone()
@@ -2220,6 +2221,7 @@ func TestFragmentationErrors(t *testing.T) {
 			ep := iptestutil.NewMockLinkEndpoint(ft.mtu, ft.mockError, ft.allowPackets)
 			defer ep.Close()
 			r := buildRoute(t, ctx, ep)
+			defer r.Release()
 			pkt := iptestutil.MakeRandPkt(ft.transportHeaderLength, extraHeaderReserve+header.IPv4MinimumSize, []int{ft.payloadSize}, header.IPv4ProtocolNumber)
 			defer pkt.DecRef()
 			err := r.WritePacket(stack.NetworkHeaderParams{
@@ -3429,6 +3431,7 @@ func TestWriteStats(t *testing.T) {
 			ep := iptestutil.NewMockLinkEndpoint(header.IPv4MinimumMTU, &tcpip.ErrInvalidEndpointState{}, test.allowPackets)
 			defer ep.Close()
 			rt := buildRoute(t, ctx, ep)
+			defer rt.Release()
 
 			test.setup(t, rt.Stack())
 			nWritten := 0

pkg/tcpip/network/ipv6/ipv6_test.go

@@ -2586,6 +2586,7 @@ func TestWriteStats(t *testing.T) {
 			defer ep.Close()
 
 			rt := buildRoute(t, c, ep)
+			defer rt.Release()
 			test.setup(t, rt.Stack())
 
 			nWritten := 0
@@ -2794,6 +2795,7 @@ func TestFragmentationWritePacket(t *testing.T) {
 			defer ep.Close()
 
 			r := buildRoute(t, c, ep)
+			defer r.Release()
 			err := r.WritePacket(stack.NetworkHeaderParams{
 				Protocol: tcp.ProtocolNumber,
 				TTL:      ttl,
@@ -2896,6 +2898,7 @@ func TestFragmentationErrors(t *testing.T) {
 			defer ep.Close()
 
 			r := buildRoute(t, c, ep)
+			defer r.Release()
 			err := r.WritePacket(stack.NetworkHeaderParams{
 				Protocol: tcp.ProtocolNumber,
 				TTL:      ttl,

pkg/tcpip/stack/addressable_endpoint_state.go

@@ -684,12 +684,6 @@ func (a *AddressableEndpointState) Cleanup() {
 	}
 }
 
-// LeakCheckDisabled suppress reference leak warnings.
-// FIXME(b/261201456): Re-enable after fixing the bug.
-func (obj *addressStateRefs) LeakCheckDisabled() bool {
-	return true
-}
-
 var _ AddressEndpoint = (*addressState)(nil)
 
 // addressState holds state for an address.

pkg/tcpip/stack/stack.go

@@ -1764,6 +1764,12 @@ func (s *Stack) Wait() {
 	}
 }
 
+// Destroy destroys the stack with all endpoints.
+func (s *Stack) Destroy() {
+	s.Close()
+	s.Wait()
+}
+
 // Pause pauses any protocol level background workers.
 func (s *Stack) Pause() {
 	for _, p := range s.transportProtocols {

pkg/tcpip/tests/integration/forward_test.go

@@ -235,8 +235,11 @@ func TestForwarding(t *testing.T) {
 					}
 
 					host1Stack := stack.New(stackOpts)
+					defer host1Stack.Destroy()
 					routerStack := stack.New(stackOpts)
+					defer routerStack.Destroy()
 					host2Stack := stack.New(stackOpts)
+					defer host2Stack.Destroy()
 					utils.SetupRoutedStacks(t, host1Stack, routerStack, host2Stack)
 
 					epsAndAddrs := test.epAndAddrs(t, host1Stack, routerStack, host2Stack, subTest.proto)

pkg/tcpip/tests/integration/iptables_test.go

@@ -331,6 +331,7 @@ func TestIPTablesStatsForInput(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			s, e := test.setupStack(t)
+			defer s.Destroy()
 			test.setupFilter(t, s)
 			e.InjectInbound(test.proto, test.genPacket())
 
@@ -588,6 +589,7 @@ func TestIPTableWritePackets(t *testing.T) {
 				NetworkProtocols:   []stack.NetworkProtocolFactory{ipv4.NewProtocol, ipv6.NewProtocol},
 				TransportProtocols: []stack.TransportProtocolFactory{udp.NewProtocol},
 			})
+			defer s.Destroy()
 			e := channelEndpoint{
 				Endpoint: channel.New(4, header.IPv6MinimumMTU, linkAddr),
 				t:        t,
@@ -843,6 +845,7 @@ func TestForwardingHook(t *testing.T) {
 					s := stack.New(stack.Options{
 						NetworkProtocols: []stack.NetworkProtocolFactory{ipv4.NewProtocol, ipv6.NewProtocol},
 					})
+					defer s.Destroy()
 
 					subTest.setupFilter(t, s, test.netProto)
 
@@ -1062,6 +1065,7 @@ func TestFilteringEchoPacketsWithLocalForwarding(t *testing.T) {
 					s := stack.New(stack.Options{
 						NetworkProtocols: []stack.NetworkProtocolFactory{ipv4.NewProtocol, ipv6.NewProtocol},
 					})
+					defer s.Destroy()
 
 					subTest.setupFilter(t, s, test.netProto)
 
@@ -1523,6 +1527,7 @@ func TestNATEcho(t *testing.T) {
 								NetworkProtocols:   []stack.NetworkProtocolFactory{ipv4.NewProtocol, ipv6.NewProtocol},
 								TransportProtocols: []stack.TransportProtocolFactory{icmp.NewProtocol4, icmp.NewProtocol6},
 							})
+							defer s.Destroy()
 
 							ep1 := channel.New(1, header.IPv6MinimumMTU, "")
 							ep2 := channel.New(1, header.IPv6MinimumMTU, "")
@@ -1904,8 +1909,11 @@ func TestNAT(t *testing.T) {
 							}
 
 							host1Stack := stack.New(stackOpts)
+							defer host1Stack.Destroy()
 							routerStack := stack.New(stackOpts)
+							defer routerStack.Destroy()
 							host2Stack := stack.New(stackOpts)
+							defer host2Stack.Destroy()
 							utils.SetupRoutedStacks(t, host1Stack, routerStack, host2Stack)
 
 							epsAndAddrs := test.epAndAddrs(t, host1Stack, routerStack, host2Stack, subTest.proto)
@@ -2455,6 +2463,7 @@ func TestNATICMPError(t *testing.T) {
 										NetworkProtocols:   []stack.NetworkProtocolFactory{ipv4.NewProtocol, ipv6.NewProtocol},
 										TransportProtocols: []stack.TransportProtocolFactory{udp.NewProtocol, tcp.NewProtocol},
 									})
+									defer s.Destroy()
 
 									ep1 := channel.New(1, header.IPv6MinimumMTU, "")
 									ep2 := channel.New(1, header.IPv6MinimumMTU, "")
@@ -2833,6 +2842,7 @@ func TestSNATHandlePortOrIdentConflicts(t *testing.T) {
 												NetworkProtocols:   []stack.NetworkProtocolFactory{ipv4.NewProtocol, ipv6.NewProtocol},
 												TransportProtocols: []stack.TransportProtocolFactory{udp.NewProtocol, tcp.NewProtocol},
 											})
+											defer s.Destroy()
 
 											ep1 := channel.New(1, header.IPv6MinimumMTU, "")
 											ep2 := channel.New(1, header.IPv6MinimumMTU, "")
@@ -2941,6 +2951,7 @@ func TestLocallyRoutedPackets(t *testing.T) {
 				NetworkProtocols:   []stack.NetworkProtocolFactory{ipv4.NewProtocol, ipv6.NewProtocol},
 				TransportProtocols: []stack.TransportProtocolFactory{udp.NewProtocol},
 			})
+			defer s.Destroy()
 
 			if err := s.CreateNIC(nicID, loopback.New()); err != nil {
 				t.Fatalf("CreateNIC(%d, _) = %s", nicID, err)
@@ -3274,6 +3285,7 @@ func TestRejectWith(t *testing.T) {
 								NetworkProtocols:   []stack.NetworkProtocolFactory{ipv4.NewProtocol, ipv6.NewProtocol},
 								TransportProtocols: []stack.TransportProtocolFactory{udp.NewProtocol, tcp.NewProtocol},
 							})
+							defer s.Destroy()
 
 							ep1 := channel.New(1, header.IPv6MinimumMTU, "")
 							ep2 := channel.New(1, header.IPv6MinimumMTU, "")

pkg/tcpip/tests/integration/istio_test.go

@@ -93,9 +93,9 @@ type testContext struct {
 
 func (ctx *testContext) cleanup() {
 	ctx.localServerListener.Close()
-	ctx.localStack.Close()
+	ctx.localStack.Destroy()
 	ctx.remoteServerListener.Close()
-	ctx.remoteStack.Close()
+	ctx.remoteStack.Destroy()
 	ctx.wg.Wait()
 }
 
@@ -120,7 +120,6 @@ func newTestContext(t *testing.T) *testContext {
 		TransportProtocols: []stack.TransportProtocolFactory{tcp.NewProtocol},
 		HandleLocal:        true,
 	})
-
 	remoteStack := stack.New(stack.Options{
 		NetworkProtocols:   []stack.NetworkProtocolFactory{ipv4.NewProtocol},
 		TransportProtocols: []stack.TransportProtocolFactory{tcp.NewProtocol},

pkg/tcpip/tests/integration/link_resolution_test.go

@@ -160,7 +160,9 @@ func TestPing(t *testing.T) {
 				TransportProtocols: []stack.TransportProtocolFactory{icmp.NewProtocol4, icmp.NewProtocol6},
 			}
 
-			host1Stack, _ := setupStack(t, stackOpts, host1NICID, host2NICID)
+			host1Stack, host2Stack := setupStack(t, stackOpts, host1NICID, host2NICID)
+			defer host1Stack.Destroy()
+			defer host2Stack.Destroy()
 
 			var wq waiter.Queue
 			we, waiterCH := waiter.NewChannelEntry(waiter.ReadableEvents)
@@ -304,6 +306,8 @@ func TestTCPLinkResolutionFailure(t *testing.T) {
 			}
 
 			host1Stack, host2Stack := setupStack(t, stackOpts, host1NICID, host2NICID)
+			defer host1Stack.Destroy()
+			defer host2Stack.Destroy()
 
 			var listenerWQ waiter.Queue
 			listenerEP, err := host2Stack.NewEndpoint(tcp.ProtocolNumber, test.netProto, &listenerWQ)
@@ -571,6 +575,7 @@ func TestForwardingWithLinkResolutionFailure(t *testing.T) {
 				TransportProtocols: []stack.TransportProtocolFactory{test.transportProtocol},
 				Clock:              clock,
 			})
+			defer s.Destroy()
 
 			// Set up endpoint through which we will receive packets.
 			incomingEndpoint := channel.New(1, test.mtu, "")
@@ -724,7 +729,9 @@ func TestGetLinkAddress(t *testing.T) {
 				Clock:            clock,
 			}
 
-			host1Stack, _ := setupStack(t, stackOpts, host1NICID, host2NICID)
+			host1Stack, host2Stack := setupStack(t, stackOpts, host1NICID, host2NICID)
+			defer host1Stack.Destroy()
+			defer host2Stack.Destroy()
 
 			ch := make(chan stack.LinkResolutionResult, 1)
 			err := host1Stack.GetLinkAddress(host1NICID, test.remoteAddr, test.localAddr, test.netProto, func(r stack.LinkResolutionResult) {
@@ -833,7 +840,9 @@ func TestRouteResolvedFields(t *testing.T) {
 				Clock:            clock,
 			}
 
-			host1Stack, _ := setupStack(t, stackOpts, host1NICID, host2NICID)
+			host1Stack, host2Stack := setupStack(t, stackOpts, host1NICID, host2NICID)
+			defer host1Stack.Destroy()
+			defer host2Stack.Destroy()
 			r, err := host1Stack.FindRoute(host1NICID, test.localAddr, test.remoteAddr, test.netProto, false /* multicastLoop */)
 			if err != nil {
 				t.Fatalf("host1Stack.FindRoute(%d, %s, %s, %d, false): %s", host1NICID, test.localAddr, test.remoteAddr, test.netProto, err)
@@ -935,6 +944,8 @@ func TestWritePacketsLinkResolution(t *testing.T) {
 			}
 
 			host1Stack, host2Stack := setupStack(t, stackOpts, host1NICID, host2NICID)
+			defer host1Stack.Destroy()
+			defer host2Stack.Destroy()
 
 			var serverWQ waiter.Queue
 			serverWE, serverCH := waiter.NewChannelEntry(waiter.ReadableEvents)
@@ -1333,8 +1344,11 @@ func TestTCPConfirmNeighborReachability(t *testing.T) {
 			host1StackOpts.NUDDisp = &nudDisp
 
 			host1Stack := stack.New(host1StackOpts)
+			defer host1Stack.Destroy()
 			routerStack := stack.New(stackOpts)
+			defer routerStack.Destroy()
 			host2Stack := stack.New(stackOpts)
+			defer host2Stack.Destroy()
 			utils.SetupRoutedStacks(t, host1Stack, routerStack, host2Stack)
 
 			// Add a reachable dynamic entry to our neighbor table for the remote.
@@ -1592,7 +1606,9 @@ func TestDAD(t *testing.T) {
 				},
 			}
 
-			host1Stack, _ := setupStack(t, stackOpts, utils.Host1NICID, utils.Host2NICID)
+			host1Stack, host2Stack := setupStack(t, stackOpts, utils.Host1NICID, utils.Host2NICID)
+			defer host1Stack.Destroy()
+			defer host2Stack.Destroy()
 
 			// DAD should be disabled by default.
 			if res, err := host1Stack.CheckDuplicateAddress(utils.Host1NICID, test.netProto, test.remoteAddr, func(r stack.DADResult) {
@@ -1753,6 +1769,8 @@ func TestUpdateCachedNeighborEntry(t *testing.T) {
 
 	host1Stack := stack.New(stackOpts)
 	host2Stack := stack.New(stackOpts)
+	defer host1Stack.Destroy()
+	defer host2Stack.Destroy()
 
 	host1Pipe, host2Pipe := pipe.New(utils.LinkAddr1, utils.LinkAddr2, maxFrameSize)
 

pkg/tcpip/tests/integration/loopback_test.go

@@ -85,6 +85,7 @@ func TestInitialLoopbackAddresses(t *testing.T) {
 			},
 		})},
 	})
+	defer s.Destroy()
 
 	if err := s.CreateNIC(nicID, loopback.New()); err != nil {
 		t.Fatalf("CreateNIC(%d, _): %s", nicID, err)
@@ -193,6 +194,7 @@ func TestLoopbackAcceptAllInSubnetUDP(t *testing.T) {
 				NetworkProtocols:   []stack.NetworkProtocolFactory{ipv4.NewProtocol, ipv6.NewProtocol},
 				TransportProtocols: []stack.TransportProtocolFactory{udp.NewProtocol},
 			})
+			defer s.Destroy()
 			if err := s.CreateNIC(nicID, loopback.New()); err != nil {
 				t.Fatalf("CreateNIC(%d, _): %s", nicID, err)
 			}
@@ -288,6 +290,7 @@ func TestLoopbackSubnetLifetimeBoundToAddr(t *testing.T) {
 	s := stack.New(stack.Options{
 		NetworkProtocols: []stack.NetworkProtocolFactory{ipv4.NewProtocol},
 	})
+	defer s.Destroy()
 	if err := s.CreateNIC(nicID, loopback.New()); err != nil {
 		t.Fatalf("s.CreateNIC(%d, _): %s", nicID, err)
 	}
@@ -429,6 +432,7 @@ func TestLoopbackAcceptAllInSubnetTCP(t *testing.T) {
 				NetworkProtocols:   []stack.NetworkProtocolFactory{ipv4.NewProtocol, ipv6.NewProtocol},
 				TransportProtocols: []stack.TransportProtocolFactory{tcp.NewProtocol},
 			})
+			defer s.Destroy()
 			if err := s.CreateNIC(nicID, loopback.New()); err != nil {
 				t.Fatalf("CreateNIC(%d, _): %s", nicID, err)
 			}
@@ -690,6 +694,7 @@ func TestExternalLoopbackTraffic(t *testing.T) {
 				},
 				TransportProtocols: []stack.TransportProtocolFactory{icmp.NewProtocol4, icmp.NewProtocol6},
 			})
+			defer s.Destroy()
 			e := channel.New(1, header.IPv6MinimumMTU, "")
 			if err := s.CreateNIC(nicID1, e); err != nil {
 				t.Fatalf("CreateNIC(%d, _): %s", nicID1, err)

pkg/tcpip/tests/integration/multicast_forward_test.go

@@ -420,7 +420,7 @@ func TestAddMulticastRoute(t *testing.T) {
 				s := stack.New(stack.Options{
 					NetworkProtocols: []stack.NetworkProtocolFactory{ipv4.NewProtocol, ipv6.NewProtocol},
 				})
-				defer s.Close()
+				defer s.Destroy()
 
 				endpoints := make(map[tcpip.NICID]*channel.Endpoint)
 				for nicID, addrType := range endpointConfigs {
@@ -550,7 +550,7 @@ func TestEnableMulticastForwardingE(t *testing.T) {
 					NetworkProtocols:   []stack.NetworkProtocolFactory{ipv4.NewProtocol, ipv6.NewProtocol},
 					TransportProtocols: []stack.TransportProtocolFactory{udp.NewProtocol},
 				})
-				defer s.Close()
+				defer s.Destroy()
 
 				for _, wantResult := range test.wantResult {
 					alreadyEnabled, err := s.EnableMulticastForwardingForProtocol(protocol, test.eventDispatcher)
@@ -641,7 +641,7 @@ func TestMulticastRouteLastUsedTime(t *testing.T) {
 					TransportProtocols: []stack.TransportProtocolFactory{udp.NewProtocol},
 					Clock:              clock,
 				})
-				defer s.Close()
+				defer s.Destroy()
 
 				if _, err := s.EnableMulticastForwardingForProtocol(protocol, &fakeMulticastEventDispatcher{}); err != nil {
 					t.Fatalf("s.EnableMulticastForwardingForProtocol(%d, _): (_, %s)", protocol, err)
@@ -797,7 +797,7 @@ func TestRemoveMulticastRoute(t *testing.T) {
 					NetworkProtocols:   []stack.NetworkProtocolFactory{ipv4.NewProtocol, ipv6.NewProtocol},
 					TransportProtocols: []stack.TransportProtocolFactory{udp.NewProtocol},
 				})
-				defer s.Close()
+				defer s.Destroy()
 
 				if _, err := s.EnableMulticastForwardingForProtocol(protocol, &fakeMulticastEventDispatcher{}); err != nil {
 					t.Fatalf("s.EnableMulticastForwardingForProtocol(%d, _): (_, %s)", protocol, err)
@@ -1039,7 +1039,7 @@ func TestMulticastForwarding(t *testing.T) {
 					NetworkProtocols:   []stack.NetworkProtocolFactory{ipv4.NewProtocol, ipv6.NewProtocol},
 					TransportProtocols: []stack.TransportProtocolFactory{udp.NewProtocol},
 				})
-				defer s.Close()
+				defer s.Destroy()
 
 				eventDispatcher, ok := eventDispatchers[protocol]
 				if !ok {

pkg/tcpip/tests/integration/route_test.go

@@ -179,6 +179,7 @@ func TestLocalPing(t *testing.T) {
 						TransportProtocols: []stack.TransportProtocolFactory{icmp.NewProtocol4, icmp.NewProtocol6},
 						HandleLocal:        true,
 					})
+					defer s.Destroy()
 					e := test.linkEndpoint()
 					if err := s.CreateNIC(nicID, e); err != nil {
 						t.Fatalf("s.CreateNIC(%d, _): %s", nicID, err)
@@ -301,6 +302,7 @@ func TestLocalUDP(t *testing.T) {
 					}
 
 					s := stack.New(stackOpts)
+					defer s.Destroy()
 					ep := channel.New(1, header.IPv6MinimumMTU, "")
 
 					if err := s.CreateNIC(nicID, ep); err != nil {

pkg/tcpip/transport/icmp/icmp_test.go

@@ -97,6 +97,7 @@ func TestWriteUnboundWithBindToDevice(t *testing.T) {
 		TransportProtocols: []stack.TransportProtocolFactory{icmp.NewProtocol4},
 		HandleLocal:        true,
 	})
+	defer s.Destroy()
 
 	// Add two NICs, both with default routes on the same subnet. The first NIC
 	// added will be the default NIC for that subnet.

pkg/tcpip/transport/internal/network/endpoint.go

@@ -648,6 +648,7 @@ func (e *Endpoint) ConnectAndThen(addr tcpip.FullAddress, f func(netProto tcpip.
 	}
 
 	if err := f(r.NetProto(), info.ID, id); err != nil {
+		r.Release()
 		return err
 	}
 

pkg/tcpip/transport/internal/network/endpoint_test.go

@@ -122,6 +122,7 @@ func TestEndpointStateTransitions(t *testing.T) {
 				TransportProtocols: []stack.TransportProtocolFactory{udp.NewProtocol},
 				Clock:              &faketime.NullClock{},
 			})
+			defer s.Destroy()
 			e := channel.New(1, header.IPv6MinimumMTU, "")
 			if err := s.CreateNIC(nicID, e); err != nil {
 				t.Fatalf("s.CreateNIC(%d, _): %s", nicID, err)
@@ -271,6 +272,7 @@ func TestBindNICID(t *testing.T) {
 						TransportProtocols: []stack.TransportProtocolFactory{udp.NewProtocol},
 						Clock:              &faketime.NullClock{},
 					})
+					defer s.Destroy()
 					if err := s.CreateNIC(nicID, loopback.New()); err != nil {
 						t.Fatalf("s.CreateNIC(%d, _): %s", nicID, err)
 					}

pkg/tcpip/transport/raw/endpoint.go

@@ -345,6 +345,7 @@ func (e *endpoint) write(p tcpip.Payloader, opts tcpip.WriteOptions) (int64, tcp
 	if err != nil {
 		return 0, err
 	}
+	defer ctx.Release()
 
 	if p.Len() > int(ctx.MTU()) {
 		return 0, &tcpip.ErrMessageTooLong{}