Page History

The Object.wait() method temporarily cedes possession of a lock so that another thread that is requesting the lock can proceed. Object.wait() must always be called from a synchronized block or method. To resume the waiting thread, the requesting thread must invoke the notify() method to notify it. Furthermore, the wait() method should be invoked in a loop that checks if a condition predicate holds. Note that a condition predicate is the negation of the condition expression in the loop. For example, the condition predicate for removing an element from a vector is !isEmpty(), whereas the condition expression for the while loop condition is isEmpty(). The correct way to invoke the wait() method when the vector is empty is shown below.

...

The notification mechanism notifies the waiting thread and lets it check its condition predicate. The invocation of notify() or notifyAll() in another thread cannot precisely determine which waiting thread is resumed. A condition predicate statement is provided so that only the correct thread will resume upon receiving the notification. A condition predicate also helps when a thread is required to block until a condition becomes true, such as reading data from an input stream before proceeding.

Safety and liveness are both concerns when using the wait/notify mechanism.  Safety requires that all objects to maintain consistent states in a multi-threadedmultithreaded environment \[[Lea 002000|AA. Java References#Lea 00]\]. Liveness requires that every operation or method invocation execute to completion without interruption.

To guarantee liveness, the while loop condition must be tested before invoking the wait() method is invoked. This is done in case another thread has already satisfied the condition predicate and sent a notification. Invoking the wait() method after the notification has been sent results in indefinite blocking.

To guarantee _safety_, the {{while}} loop condition must be tested even after invokingthe {{wait()}} method is invoked. While {{wait()}} is meant to block indefinitely until a notification is received, it must still be encased within a loop to prevent the following vulnerabilities \[[Bloch 012001|AA. Java References#Bloch 01]\]:

• Thread thread in the middle : - A third thread can acquire the lock on the shared object during the interval between a notification being sent and the receiving thread resuming execution. This thread can change the state of the object, leaving it inconsistent. This is a time-of-check, -to-time-of-use (TOCTOU) condition.
• Malicious malicious notification : - There is no guarantee that a random notification will not be received when the condition predicate is false. This means that the invocation of wait() may be nullified by the notification.
• Misdelivered misdelivered notification : - Sometimes on receipt of a notifyAll() signal, an unrelated thread can start executing, and it is possible for its condition predicate to be true. Consequently, it may resume execution although it was required to remain dormant.

• Wiki Markup
  Spuriousspurious wake-ups ups:- Certain JVM implementations are vulnerable to _spurious wake ups_ that result in waiting threads waking up even without a notification \[[API 062006|AA. Java References#API 06]\].

For these reasons, it is necessary to check the condition predicate must be checked after the wait() method is invoked. A while loop is the best choice for checking the condition predicate before and after invoking wait().

Similarly, the {{await()}} method of interfacethe {{Condition}} interface must also be invoked inside a loop. According to the Java API \[[API 062006|AA. Java References#API 06]\], Interface {{Condition}}:

When waiting upon a Condition, a "spurious wakeup" is permitted to occur, in general, as a concession to the underlying platform semantics. This has little practical impact on most application programs as a Condition should always be waited upon in a loop, testing the state predicate that is being waited for. An implementation is free to remove the possibility of spurious wakeups but it is recommended that applications programmers always assume that they can occur and so always wait in a loop.

...

To guarantee liveness and safety, the wait() and await() methods must always be invoked inside a while loop.

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[API 062006|AA. Java References#API 06]\] [Class Object|http://java.sun.com/javase/6/docs/api/java/lang/Object.html]
\[[Bloch 012001|AA. Java References#Bloch 01]\] Item 50: Never invoke wait outside a loop
\[[Lea 002000|AA. Java References#Lea 00]\] 3.2.2 Monitor Mechanics, 1.3.2 Liveness
\[[Goetz 062006|AA. Java References#Goetz 06]\] Section 14.2, Using Condition Queues

...