Fix tun reference counting.

The tun code does not properly abide by reference counting rules. Change it
so the ownership is more clear and to prevent potential use-after-free.

PiperOrigin-RevId: 482865862

pkg/sentry/devices/tundev/tundev.go

@@ -157,6 +157,7 @@ func (fd *tunFD) Write(ctx context.Context, src usermem.IOSequence, opts vfs.Wri
 		return 0, unix.EMSGSIZE
 	}
 	data := bufferv2.NewView(int(src.NumBytes()))
+	defer data.Release()
 	if _, err := io.CopyN(data, src.Reader(ctx), src.NumBytes()); err != nil {
 		return 0, err
 	}

pkg/sentry/fs/dev/net_tun.go

@@ -139,6 +139,7 @@ func (n *netTunFileOperations) Write(ctx context.Context, file *fs.File, src use
 		return 0, unix.EINVAL
 	}
 	data := bufferv2.NewView(int(src.NumBytes()))
+	defer data.Release()
 	if _, err := io.CopyN(data, src.Reader(ctx), src.NumBytes()); err != nil {
 		return 0, err
 	}

pkg/tcpip/link/tun/device.go

@@ -201,7 +201,10 @@ func (d *Device) Write(data *bufferv2.View) (int64, error) {
 			// Ignore bad packet.
 			return dataLen, nil
 		}
-		pktInfoHdr = PacketInfoHeader(data.AsSlice()[:PacketInfoHeaderSize])
+		pktInfoHdrView := data.Clone()
+		defer pktInfoHdrView.Release()
+		pktInfoHdrView.CapLength(PacketInfoHeaderSize)
+		pktInfoHdr = PacketInfoHeader(pktInfoHdrView.AsSlice())
 		data.TrimFront(PacketInfoHeaderSize)
 	}
 
@@ -212,7 +215,10 @@ func (d *Device) Write(data *bufferv2.View) (int64, error) {
 			// Ignore bad packet.
 			return dataLen, nil
 		}
-		ethHdr = header.Ethernet(data.AsSlice()[:header.EthernetMinimumSize])
+		ethHdrView := data.Clone()
+		defer ethHdrView.Release()
+		ethHdrView.CapLength(header.EthernetMinimumSize)
+		ethHdr = header.Ethernet(ethHdrView.AsSlice())
 		data.TrimFront(header.EthernetMinimumSize)
 	}
 
@@ -236,7 +242,7 @@ func (d *Device) Write(data *bufferv2.View) (int64, error) {
 
 	pkt := stack.NewPacketBuffer(stack.PacketBufferOptions{
 		ReserveHeaderBytes: len(ethHdr),
-		Payload:            bufferv2.MakeWithView(data),
+		Payload:            bufferv2.MakeWithView(data.Clone()),
 	})
 	defer pkt.DecRef()
 	copy(pkt.LinkHeader().Push(len(ethHdr)), ethHdr)