device: clear pointers when returning elems to pools

Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>

device/pools.go

@@ -65,6 +65,7 @@ func (device *Device) GetInboundElement() *QueueInboundElement {
 }
 
 func (device *Device) PutInboundElement(msg *QueueInboundElement) {
+	msg.clearPointers()
 	if PreallocatedBuffersPerPool == 0 {
 		device.pool.inboundElementPool.Put(msg)
 	} else {
@@ -81,6 +82,7 @@ func (device *Device) GetOutboundElement() *QueueOutboundElement {
 }
 
 func (device *Device) PutOutboundElement(msg *QueueOutboundElement) {
+	msg.clearPointers()
 	if PreallocatedBuffersPerPool == 0 {
 		device.pool.outboundElementPool.Put(msg)
 	} else {

device/receive.go

@@ -37,6 +37,17 @@ type QueueInboundElement struct {
 	endpoint conn.Endpoint
 }
 
+// clearPointers clears elem fields that contain pointers.
+// This makes the garbage collector's life easier and
+// avoids accidentally keeping other objects around unnecessarily.
+// It also reduces the possible collateral damage from use-after-free bugs.
+func (elem *QueueInboundElement) clearPointers() {
+	elem.buffer = nil
+	elem.packet = nil
+	elem.keypair = nil
+	elem.endpoint = nil
+}
+
 func (elem *QueueInboundElement) Drop() {
 	atomic.StoreInt32(&elem.dropped, AtomicTrue)
 }

device/send.go

@@ -58,9 +58,19 @@ func (device *Device) NewOutboundElement() *QueueOutboundElement {
 	elem.buffer = device.GetMessageBuffer()
 	elem.Mutex = sync.Mutex{}
 	elem.nonce = 0
+	// keypair and peer were cleared (if necessary) by clearPointers.
+	return elem
+}
+
+// clearPointers clears elem fields that contain pointers.
+// This makes the garbage collector's life easier and
+// avoids accidentally keeping other objects around unnecessarily.
+// It also reduces the possible collateral damage from use-after-free bugs.
+func (elem *QueueOutboundElement) clearPointers() {
+	elem.buffer = nil
+	elem.packet = nil
 	elem.keypair = nil
 	elem.peer = nil
-	return elem
 }
 
 func (elem *QueueOutboundElement) Drop() {