Page History

When a given thread waits (cnd_wait() or cnd_timedwait()) on a condition variable, it can be awakened as a result of a signal operation (cnd_signal()). However, if multiple threads are waiting on the same condition variable, any of those threads can be picked up selected by the scheduler to be awakened (assuming that all threads have the same priority level). 

The user programmer is forced to create a predicate-testing loop around the wait condition to guarantee that each thread executes only if its predicate test is true (recommendation in IEEE Std 1003.1 since the 2001 release [IEEE Std 1003.1-2004]). As a consequence, if a given thread finds the predicate test to be false, it waits again, eventually resulting in a deadlock situation.

...

• All threads must perform the same set of operations after waking up, which means that any thread can be selected to wake up and resume for a single invocation of cnd_signal().
• Only one thread is required to wake upon receiving the signal.

The use of cnd_signal() can is also be safe if each thread uses a unique condition variable.

The use of cnd_broadcast() avoids these problems because it wakes up all the threads associated with the condition variable, and because all the threads must reevaluate the predicate condition, one thread will find its test to be true, avoiding deadlock.

Noncompliant Code Example (cnd_signal())

The following This noncompliant code example consists of a given number of threads (5) that should execute one after another according to the step level assigned to each thread when it is created (serialized processing). The current_step variable holds the current step level and is incremented as soon as the respective thread finishes its processing. Finally, another thread is signaled so that the next step can be executed. Each thread waits until its step level is ready, and the cnd_wait() function call is wrapped inside a while loop, in compliance with CON44-C. Wrap functions that can fail spuriously in a loop.

...

This noncompliant code example violates the liveness property.

Compliant Solution (cnd_broadcast())

This compliant solution uses the cnd_broadcast() function to signal all waiting threads instead of a single random thread. Only the run_step() thread code from the noncompliant code example is modified, as follows:

...

The fact that all threads will be awake solves the problem because each one ends up executing its condition predicate test, and exactly one will succeed and continue execution.

Compliant Solution (Windows, Condition Variables)

This compliant solution uses  a CONDITION_VARIABLE object, available on Microsoft Windows (Vista and later).

#include <Windows.h>
#include <stdio.h>
 
CRITICAL_SECTION lock;
CONDITION_VARIABLE cond;
 
DWORD WINAPI run_step(LPVOID t) {
  static int current_step = 0;
  int my_step = (int)t;

  EnterCriticalSection(&lock);  
  printf("Thread %d has the lock\n", my_step);

  while (current_step != my_step) {
    printf("Thread %d is sleeping...\n", my_step);
 
    if (!SleepConditionVariableCS(&cond, &lock, INFINITE)) {
      /* Handle error condition */
    }

    printf("Thread %d woke up\n", my_step);
  }

  /* Do processing ... */
  printf("Thread %d is processing...\n", my_step);

  current_step++;
 
  LeaveCriticalSection(&lock);
 
  /* Signal ALL waiting tasks */
  WakeAllConditionVariable(&cond);
 
  printf("Thread %d is exiting...\n", my_step);
  return 0;
}
 
enum { NTHREADS = 5 };
int main(int argc, char** argv) {
  HANDLE threads[NTHREADS];
  
  InitializeCriticalSection(&lock);
  InitializeConditionVariable(&cond);
 
  /* Create threads */
  for (int i = 0; i < NTHREADS; ++i) {
    threads[i] = CreateThread(NULL, 0, run_step, (LPVOID)i, 0, NULL);
  }
 
  /* Wait for all threads to complete */
  WaitForMultipleObjects(NTHREADS, threads, TRUE, INFINITE);
 
  DeleteCriticalSection(&lock);
 
  return 0;
}

Compliant Solution (Using cnd_signal() but with a Unique Condition Variable per Thread)

Another way to solve the signal issue is to use a unique condition variable for each thread (all associated with a single mutex). In this case, the signal operation (cnd_signal()) wakes up only the thread that is waiting on it. This solution turns out to be more efficient than using cnd_broadcast() because only the desired thread is awakened.

NOTE: The condition predicate of the signaled thread must be true; otherwise, a deadlock will occur.

...

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website. 

Related Guidelines

Bibliography

...