Page History

When accessing a bit-field, a thread may inadvertently access a separate bit-field in adjacent memory. This is  because compilers are allowed to store multiple bit-fields in one addressable storage unit. Consequently, data races may exist not just on a bit-field accessed by multiple threads but also on other bit-fields sharing the same byte or word address.  A similar problem is discussed in CON00-C. Avoid race conditions with multiple threads, but this issue can be harder to diagnose because it is not immediately obvious that the same memory location is being modified.

...

Another approach is to embed a concurrently accessed object inside a union alongside a long object or other padding to ensure that the object is the only one accessed at that address. This technique effectively guarantee that no two object are accessed simultaneously.

Noncompliant Code Example (Bit-field)

Adjacent bit-fields may be stored in a single memory location. Consequently, modifying adjacent bit-fields in different threads is undefined behavior:

...

Thread 1: register 0 = flags
Thread 1: register 0 &= ~mask(flag1)
Thread 2: register 0 = flags
Thread 2: register 0 &= ~mask(flag2)
Thread 1: register 0 |= 1 << shift(flag1)
Thread 1: flags = register 0
Thread 2: register 0 |= 2 << shift(flag2)
Thread 2: flags = register 0

Compliant Solution (Bit-field, C11, Mutex)

This compliant solution protects all accesses of the flags with a mutex, thereby preventing any data races. Finally, the flags are embedded in a union alongside a long, and a static assertion guarantees that the flags do not occupy more space than the long. This technique prevents any data not checked by the mutex from being accessed or modified with the bit-fields on platforms that do not comply with C11 memory semantics.

...

Static assertions are described in detail in DCL03-C. Use a static assertion to test the value of a constant expression.

Compliant Solution (C11)

In this compliant solution, two threads simultaneously modify two distinct members of a structure:

...

In a C99 or earlier compliant compiler it is possible that flag1 and flag2 are stored in the same word. If both assignments occur on a thread-scheduling interleaving that ends with both stores occurring after one another, it is possible that only one of the flags will be set as intended, and the other flag will equal its previous value, because both members are represented by the same word, which is the smallest unit the processor can work on. Before the changed made to the C Standard for C11, there were no guarantees that these flags could be modified concurrently.

Risk Assessment

Although the race window is narrow, an assignment or an expression can evaluate improperly because of misinterpreted data resulting in a corrupted running state or unintended information disclosure.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Bibliography

...