Page History

Functions that can fail spuriously should be wrapped in a loop.  The atomic_compare_exchange_weak() and atomic_compare_exchange_weak_explicit() functions both attempt to set an atomic variable to a new value but only if it currently possesses a known old value. Unlike the related functions atomic_compare_exchange_strong() and atomic_compare_exchange_strong_explicit(), these functions are permitted to "fail spuriously," which makes them faster on some platforms. The C Standard describes this behavior in subclause 7.17.7.4, paragraph 4:

A weak compare-and-exchange operation may fail spuriously. That is, even when the contents of memory referred to by expected and object are equal, it may return zero and store back to expected the same memory contents that were originally there.

Noncompliant Code Example

In this noncompliant code example, reorganize_data_structure() is intended to be used as an argument to thrd_create().  After reorganizing, the function attempts to replace the head pointer so that it points to the new version.  If no other thread has changed the head pointer since it was originally loaded, reorganize_data_structure() is intended to exit the thread with a result of true, indicating success.  Otherwise, the new reorganization attempt is discarded and the thread is exited with a result of false.  It is assumed that a different thread will perform another attempt some time in the future.

However, This noncompliant code example calls the atomic_compare_exchange_weak() outside of a loop .  Consequently it is possible for func() to complete without actually toggleing the value of cur may fail even when the head pointer has not changed.  Therefore, reorganize_data_structure() may perform the work and then discard it unnecessarily.  If an attacker can slow down the system just enough that atomic_compare_exchange_weak() starts failing more often, performing the wasted work could exacerbate the problem, leading to a denial of service attack.

#include <stdatomic.h>
#include <stdbool.h>
#include <stdatomic<threads.h>
 
static atomic_bool cur;
 
void init_flag(void) {
  atomic_init(&cur, false);
}
 
void func(void) {
 init_flag();
 
 bool exp

struct data_structure {
  struct data_structure *next;
  /* ... */
};

extern void cleanup_data_structure(struct data_structure *head);

int reorganize_data_structure(void *thread_arg) {
  struct data_structure *_Atomic *ptr_to_head = thread_arg;
  struct data_structure *old_head = atomic_load(&curptr_to_head);
  struct data_structure *new_head;
  bool des = !exp;
 
  if (! success;

  /* ... reorganize the data structure ... */

  success = atomic_compare_exchange_weak(&curptr_to_head, &expold_head, des)new_head);
  if (!success) {
    /* Handle error */
  }
}cleanup_data_structure(new_head);
  }
  thrd_exit(success);
}

Compliant Solution (atomic_compare_exchange_weak())

A consequence of spurious failure is that nearly all uses of weak compare-and-exchange will be in a loop. This compliant solution calls the To recover from spurious failures, a loop must be used.  However, atomic_compare_exchange_weak() function from within a while loop to ensure the function does not fail spuriously.  When a compare-and-exchange is in a loop, the weak version can yield better performance on some platforms might fail in two ways: spuriously, and indicating a change to the head pointer.  There is no way to determine which is the case.  Therefore, the thread's architecture must be changed to continue to use this function.  It must perform the work repeatedly until the compare-and-exchange succeeds.  This might not be an ideal solution, depending on the application.

#include <stdatomic.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdatomic<threads.h>


static atomic_bool curstruct data_structure {
  struct data_structure *next;
  /* ... */
};

void init_flag(void) {
  atomic_init(&cur, false);
}
 
void func(void) {
  init_flag();
 
  bool expextern void cleanup_data_structure(struct data_structure *head);

int reorganize_data_structure(void *thread_arg) {
  struct data_structure *_Atomic *ptr_to_head = thread_arg;
  struct data_structure *old_head;
  struct data_structure *new_head = NULL;
  bool success;

  do {
    cleanup_data_struture(new_head);
    old_head = atomic_load(&curptr_to_head);

    bool des = !exp;
 
 /* ... reorganize the data structure ... */

  } while (!atomic_compare_exchange_weak(&curptr_to_head, &expold_head, desnew_head)) {;
    /* do nothing */
  }
}thrd_exit(true);
}

Compliant Solution (atomic_compare_exchange_strong())

When a weak compare-and-exchange would require a loop and a strong one would not, the strong one is preferable.

#include <stdatomic.h>
#include <stdbool.h>
#include <stdatomic<threads.h>

static atomic_bool curstruct data_structure {
  struct data_structure *next;
  /* ... */
};

extern void initcleanup_data_flagstructure(void) {
  atomic_init(&cur, falsestruct data_structure *head);
}
 
void func(voidint reorganize_data_structure(void *thread_arg) {
  struct data_structure  init_flag()*_Atomic *ptr_to_head = thread_arg;
 
 struct bool expdata_structure *old_head = atomic_load(&curptr_to_head);
  struct  bool des = !exp;
 
  if (!data_structure *new_head;
  bool success;

  /* ... reorganize the data structure ... */

  success = atomic_compare_exchange_strong(&curptr_to_head, &exp, desold_head, new_head);
  if (!success) {
    /* Handle error */
  }
}cleanup_data_structure(new_head);
  }
  thrd_exit(success);
}

Failing to wrap the atomic_compare_exchange_weak() and atomic_compare_exchange_weak_explicit() functions in a loop can result in incorrect values and control flow.

Related Guidelines

Bibliography