net: fix TCPListener file leak to child processes

Hold ForkLock during dup of fd + cloexec in the net pkg,
per the locking policy documented in syscall/exec_unix.go.

R=golang-dev, dsymonds, adg
CC=golang-dev
https://golang.org/cl/6457080
diff --git a/src/pkg/net/fd.go b/src/pkg/net/fd.go
index 76c953b..ff4f4f8 100644
--- a/src/pkg/net/fd.go
+++ b/src/pkg/net/fd.go
@@ -645,10 +645,14 @@
 }
 
 func (fd *netFD) dup() (f *os.File, err error) {
+	syscall.ForkLock.RLock()
 	ns, err := syscall.Dup(fd.sysfd)
 	if err != nil {
+		syscall.ForkLock.RUnlock()
 		return nil, &OpError{"dup", fd.net, fd.laddr, err}
 	}
+	syscall.CloseOnExec(ns)
+	syscall.ForkLock.RUnlock()
 
 	// We want blocking mode for the new fd, hence the double negative.
 	if err = syscall.SetNonblock(ns, false); err != nil {