Close can panic

[ncabatoff]

Our CI has failed a couple of times lately with this error:

panic: sync: negative WaitGroup counter

goroutine 3436 [running]:
sync.(*WaitGroup).Add(0xc000051ad8, 0xffffffffffffffff)
	/usr/local/go/src/sync/waitgroup.go:74 +0x20c
sync.(*WaitGroup).Done(...)
	/usr/local/go/src/sync/waitgroup.go:99
github.com/hashicorp/vault/vendor/github.com/go-ldap/ldap.(*Conn).Close(0xc000051a80)
	/go/src/github.com/hashicorp/vault/vendor/github.com/go-ldap/ldap/conn.go:221 +0x293
github.com/hashicorp/vault/vendor/github.com/go-ldap/ldap.(*Conn).reader.func1(0xc000d8cf36, 0xc000051a80)
	/go/src/github.com/hashicorp/vault/vendor/github.com/go-ldap/ldap/conn.go:479 +0x81
github.com/hashicorp/vault/vendor/github.com/go-ldap/ldap.(*Conn).reader(0xc000051a80)
	/go/src/github.com/hashicorp/vault/vendor/github.com/go-ldap/ldap/conn.go:495 +0x3da
created by github.com/hashicorp/vault/vendor/github.com/go-ldap/ldap.(*Conn).Start
	/go/src/github.com/hashicorp/vault/vendor/github.com/go-ldap/ldap/conn.go:190 +0x51

We're using v3.0.2 of go-ldap/ldap. It looks like this is happening because it's possible for Close to be called from reader's defer, before Start has been able to call wgClose.Add.

[ncabatoff]

Here is an easy way to reproduce:

func TestCloseRace(t *testing.T) {
	ptc := newPacketTranslatorConn()
	for {
		conn := NewConn(ptc, false)
		conn.Start()
		conn.Close()
		time.Sleep(100*time.Millisecond)
	}
}