Continue reaping bucket after reaping a tuple

Reaping an expired tuple removes it from its bucket so we need to grab
the succeeding tuple in the bucket before reaping the expired tuple.

Before this change, only the first expired tuple in a bucket was reaped
per reaper run on the bucket. This change just allows more connections
to be reaped.

PiperOrigin-RevId: 404392925

1 files changed, 6 insertions, 1 deletions

diff --git a/pkg/tcpip/stack/conntrack.go b/pkg/tcpip/stack/conntrack.go
index 89f8ef09f..a3f403855 100644
--- a/pkg/tcpip/stack/conntrack.go
+++ b/pkg/tcpip/stack/conntrack.go
@@ -562,11 +562,16 @@ func (ct *ConnTrack) reapUnused(start int, prevInterval time.Duration) (int, tim
 		idx = (i + start) % len(ct.buckets)
 		bkt := &ct.buckets[idx]
 		bkt.mu.Lock()
-		for tuple := bkt.tuples.Front(); tuple != nil; tuple = tuple.Next() {
+		for tuple := bkt.tuples.Front(); tuple != nil; {
+			// reapTupleLocked updates tuple's next pointer so we grab it here.
+			nextTuple := tuple.Next()
+
 			checked++
 			if ct.reapTupleLocked(tuple, idx, bkt, now) {
 				expired++
 			}
+
+			tuple = nextTuple
 		}
 		bkt.mu.Unlock()
 	}