Lock ConnTrack before initializing buckets

PiperOrigin-RevId: 355751801

1 files changed, 6 insertions, 0 deletions

diff --git a/pkg/tcpip/stack/conntrack.go b/pkg/tcpip/stack/conntrack.go
index 54617f2e6..cdb435644 100644
--- a/pkg/tcpip/stack/conntrack.go
+++ b/pkg/tcpip/stack/conntrack.go
@@ -231,6 +231,12 @@ func newConn(orig, reply tupleID, manip manipType, hook Hook) *conn {
 	return &conn
 }
 
+func (ct *ConnTrack) init() {
+	ct.mu.Lock()
+	defer ct.mu.Unlock()
+	ct.buckets = make([]bucket, numBuckets)
+}
+
 // connFor gets the conn for pkt if it exists, or returns nil
 // if it does not. It returns an error when pkt does not contain a valid TCP
 // header.