RLC: a D2D UM TX entity must withdraw from the mode controller before it dies

D2DModeController::perPeerTxEntities_ holds raw pointers to RLC UM TX entity
*modules*, filed by peer when the entity learns its flow. Nothing ever removed
them, while BearerManagement::deleteLocalRlcQueues() deletes those modules on
every handover and on bearer teardown, so the registry accumulated dangling
pointers. The next registration for the same peer walks the set and calls the
virtual isEmptyingBuffer() on freed memory:

  Invalid read of size 8
     at D2DModeController::isEmptyingTxBuffer()      D2DModeController.cc:41
     by D2DModeController::registerD2DPeerTxEntity() D2DModeController.cc:18
     by RlcUmTxEntityD2D<LteRlcUmTxEntity>::setFlowControlInfo()
     by BearerManagement::installRlcTxSide()         BearerManagement.cc:417
   Address is 344 bytes inside a block of size 464 free'd
     at LteRlcUmTxEntityD2D::~LteRlcUmTxEntityD2D()
     by BearerManagement::deleteLocalRlcQueues()     BearerManagement.cc:688
     by HandoverController::deleteOldBuffers()
     by HandoverController::doHandover()

Once the freed block is recycled the vptr slot reads back as 0 and the call
jumps to address 0. That is the SIGSEGV that killed lte/cars VoIP-D2D at
t~19.1s -- with no usable stack, since nothing valid is left on it.

The registration moved into the entity itself when the D2D code was split out
(it used to be done by BearerManagement for every UM entity), so the withdrawal
belongs there too, rather than putting a D2DModeController reference back into
the core RLC/RRC code. The entity records the peer it was filed under, so it
withdraws under exactly that key, and re-setting the flow re-files it. The
ModuleRefByPar is already null when the controller itself is gone, which covers
the whole-NIC teardown case.

Only reachable when entities are deleted while the simulation runs -- a
handover or a bearer teardown -- so the static scenarios never build up a stale
pointer: full fingerprint suite 182/182 PASS, CSVs unchanged.

lte/cars VoIP-D2D now runs to completion (100s) where it died in a SIGSEGV at
t~19.1s, both on this branch and on plain inet/dev. The registry has never had
a withdrawal path (the pre-split code did not either), so this is a long-
standing defect whose visible outcome depended on allocator luck.

Author: torokati44

src/simu5g/stack/d2d/rlc/RlcUmEntityD2D.h

@@ -56,6 +56,10 @@ class RlcUmTxEntityD2D : public Base, public ID2dRlcUmTxEntity
     // D2D mode-switch controller of this NIC (absent on non-D2D stacks)
     inet::ModuleRefByPar<D2DModeController> d2dModeController_;
 
+    // peer this entity is currently registered under at the controller, so that it can
+    // withdraw itself under exactly the key it was filed under (see ~RlcUmTxEntityD2D)
+    MacNodeId registeredPeerId_ = NODEID_NONE;
+
     // if true, the entity watches for its TX buffer becoming empty
     bool notifyEmptyBuffer_ = false;
 
@@ -79,8 +83,26 @@ class RlcUmTxEntityD2D : public Base, public ID2dRlcUmTxEntity
         // D2D peer tracking: register with the mode controller now that the peer id
         // is known, so mode switches can coordinate holding/draining of the buffers
         // (this used to be done by BearerManagement for every UM entity).
-        if (d2dModeController_)
-            d2dModeController_->registerD2DPeerTxEntity(MacNodeId(this->flowControlInfo_->getD2dRxPeerId()), this);
+        if (d2dModeController_) {
+            unregisterFromD2DModeController();  // no-op unless the flow is being re-set
+            registeredPeerId_ = MacNodeId(this->flowControlInfo_->getD2dRxPeerId());
+            d2dModeController_->registerD2DPeerTxEntity(registeredPeerId_, this);
+        }
+    }
+
+    /**
+     * Withdraw from the controller's per-peer registry. That registry holds raw pointers to
+     * these entity modules, and BearerManagement::deleteLocalRlcQueues() deletes them on
+     * handover and on bearer teardown, so an entity that goes away without withdrawing
+     * leaves a dangling pointer behind -- which the next registration for the same peer then
+     * calls isEmptyingBuffer() on. The ModuleRefByPar is null once the controller itself is
+     * gone, which is the case when the whole NIC is being torn down.
+     */
+    void unregisterFromD2DModeController()
+    {
+        if (d2dModeController_ && registeredPeerId_ != NODEID_NONE)
+            d2dModeController_->unregisterD2DPeerTxEntity(registeredPeerId_, this);
+        registeredPeerId_ = NODEID_NONE;
     }
 
     // park the SDU while the old-mode entity is still draining
@@ -113,6 +135,8 @@ class RlcUmTxEntityD2D : public Base, public ID2dRlcUmTxEntity
     virtual void resetTxNumbering() = 0;
 
   public:
+    ~RlcUmTxEntityD2D() override { unregisterFromD2DModeController(); }
+
     void startHoldingDownstreamInPackets() override { holdingDownstreamInPackets_ = true; }
 
     bool isHoldingDownstreamInPackets() override { return holdingDownstreamInPackets_; }

src/simu5g/stack/d2d/rrc/D2DModeController.cc

@@ -19,6 +19,17 @@ void D2DModeController::registerD2DPeerTxEntity(MacNodeId peerId, ID2dRlcUmTxEnt
         umTxEnt->startHoldingDownstreamInPackets();
 }
 
+void D2DModeController::unregisterD2DPeerTxEntity(MacNodeId peerId, ID2dRlcUmTxEntity *umTxEnt)
+{
+    auto it = perPeerTxEntities_.find(peerId);
+    if (it == perPeerTxEntities_.end())
+        return;
+
+    it->second.erase(umTxEnt);
+    if (it->second.empty())
+        perPeerTxEntities_.erase(it);
+}
+
 void D2DModeController::resumeDownstreamInPackets(MacNodeId peerId)
 {
     if (peerId == NODEID_NONE || (perPeerTxEntities_.find(peerId) == perPeerTxEntities_.end()))

src/simu5g/stack/d2d/rrc/D2DModeController.h

@@ -23,6 +23,12 @@ class D2DModeController : public cSimpleModule
 
   public:
     virtual void registerD2DPeerTxEntity(MacNodeId peerId, ID2dRlcUmTxEntity *umTxEnt);
+    /**
+     * Counterpart of registerD2DPeerTxEntity(). This map holds raw pointers to entity
+     * *modules*, which BearerManagement::deleteLocalRlcQueues() deletes on handover and on
+     * bearer teardown, so every registered entity has to withdraw itself before it goes.
+     */
+    virtual void unregisterD2DPeerTxEntity(MacNodeId peerId, ID2dRlcUmTxEntity *umTxEnt);
     virtual void resumeDownstreamInPackets(MacNodeId peerId);
     virtual bool isEmptyingTxBuffer(MacNodeId peerId);
 };