Fix a nasty data race in the ue_bearer_manager class. The underlying std::map member was being accessed concurrently potentially corrupting memory.

lib/include/srsran/common/bearer_manager.h

@@ -104,11 +104,23 @@ public:
   /// All registered bearer are removed (e.g. after connection release)
   void reset();
 
-  bool has_active_radio_bearer(uint32_t eps_bearer_id) { return impl.has_active_radio_bearer(eps_bearer_id); }
-
-  radio_bearer_t get_radio_bearer(uint32_t eps_bearer_id) { return impl.get_radio_bearer(eps_bearer_id); }
-
-  radio_bearer_t get_lcid_bearer(uint32_t lcid) { return impl.get_lcid_bearer(lcid); }
+  bool has_active_radio_bearer(uint32_t eps_bearer_id)
+  {
+    srsran::rwlock_read_guard rw_lock(rwlock);
+    return impl.has_active_radio_bearer(eps_bearer_id);
+  }
+
+  radio_bearer_t get_radio_bearer(uint32_t eps_bearer_id)
+  {
+    srsran::rwlock_read_guard rw_lock(rwlock);
+    return impl.get_radio_bearer(eps_bearer_id);
+  }
+
+  radio_bearer_t get_lcid_bearer(uint32_t lcid)
+  {
+    srsran::rwlock_read_guard rw_lock(rwlock);
+    return impl.get_lcid_bearer(lcid);
+  }
 
 private:
   pthread_rwlock_t                       rwlock = {}; /// RW lock to protect access from RRC/GW threads

lib/src/common/bearer_manager.cc

@@ -102,6 +102,7 @@ void ue_bearer_manager::remove_eps_bearer(uint8_t eps_bearer_id)
 
 void ue_bearer_manager::reset()
 {
+  srsran::rwlock_write_guard rw_lock(rwlock);
   impl.reset();
   logger.info("Bearers: Reset EPS bearer manager");
 }