Functions that can fail spuriously should be wrapped in a loop. The atomic_compare_exchange_weak()
and atomic_compare_exchange_weak_explicit()
functions both attempt to set an atomic variable to a new value , but only if it currently possesses a known old value. Unlike their cousins the related functions atomic_compare_exahcngeexchange_strong()
and atomic_compare_exchange_strong_explicit()
, these functions are permitted to "fail spuriously", which makes them faster on some platforms. C11, section . This makes these functions faster on some platforms—for example, on architectures that implement compare-and-exchange using load-linked/store-conditional instructions, such as Alpha, ARM, MIPS, and PowerPC. The C Standard, 7.17.7.4, paragraph 6 says:
EXAMPLE
A consequence of spurious failure is that nearly all uses of weak compare-and-exchange will be in a loop.
exp5 [ISO/IEC 9899:2024], describes this behavior:
A weak compare-and-exchange operation may fail spuriously. That is, even when the contents of memory referred to by expected
and object
are equal, it may return zero and store back to expected
the same memory contents that were originally there.
Noncompliant Code Example
In this noncompliant code example, reorganize_data_structure()
is to be used as an argument to thrd_create()
. After reorganizing, the function attempts to replace the head pointer so that it points to the new version. If no other thread has changed the head pointer since it was originally loaded, reorganize_data_structure()
is intended to exit the thread with a result of true
, indicating success. Otherwise, the new reorganization attempt is discarded and the thread is exited with a result of false
. However, atomic_compare_exchange_weak()
may fail even when the head pointer has not changed. Therefore, reorganize_data_structure()
may perform the work and then discard it unnecessarily.
Code Block |
---|
|
#include <stdatomic.h>
#include <stdbool.h>
struct data {
struct data *next;
/* ... */
};
extern void cleanup_data_structure(struct data *head);
int reorganize_data_structure(void *thread_arg) {
struct data *_Atomic *ptr_to_head = thread_arg;
struct data *old_head = atomic_load( |
&cur)ptr_to_head);
struct data *new_head;
|
do{ des = function(exp);... Reorganize the data structure ... */
|
}while(!atomic_compare_exchange_weak( |
&cur, &exp, des));
When a compare-and-exchange is in a loop, the weak version will yield better performance on some platforms. When a weak compare-and-exchange would require a loop and a strong one would not, the strong one is preferable.ptr_to_head,
&old_head, new_head);
if (!success) {
cleanup_data_structure(new_head);
}
return success; /* Exit the thread */
}
|
Compliant Solution (atomic_compare_exchange_weak()
)
To recover from spurious failures, a loop must be used. However, atomic_compare_exchange_weak()
might fail because the head pointer changed, or the failure may be spurious. In either case, the thread must perform the work repeatedly until the compare-and-exchange succeeds, as shown in this compliant solution:
The cnd_wait()
and cnd_timedwait()
functions temporarily cede possession of a mutex so that other threads that may be requesting the mutex can proceed. These functions must always be called from code that is protected by some kind of lock. The waiting thread resumes execution only after it has been notified, generally as the result of the invocation of the cnd_signal()
or cnd_broadcast()
function by some other thread. The cnd_wait()
function must be invoked from a loop that checks whether a condition predicate holds. A condition predicate is an expression constructed from the variables of a function that must be true for a thread to be allowed to continue execution. The thread pauses execution, via cnd_wait()
, cnd_timedwait()
, or some other mechanism, and is resumed later, presumably when the condition predicate is true and when the thread is notified. Note that a condition predicate is typically the negation of the condition expression in the loop. For example, the condition predicate for removing an element from a linked list is (list->next != NULL)
, whereas the condition expression for the while loop condition is (list->next == NULL)
. Following is the correct way to invoke the cnd_wait()
function when the list is empty.
struct node_t#include <stdatomic.h>
#include <stdbool.h>
#include <stddef.h>
struct data {
struct |
void nodestruct node_t* next;structnode_t list;
static mtx_t lock;
static cnd_t condition;
void consume_list_element() {
int result;
if ((result = mtx_lock(&lock)) != thrd_success) {
/* handle error */
}
while (list.next ==cleanup_data_structure(struct data *head);
int reorganize_data_structure(void *thread_arg) {
struct data *_Atomic *ptr_to_head = thread_arg;
struct data *old_head = atomic_load(ptr_to_head);
struct data *new_head = NULL;
struct data *saved_old_head;
bool success;
do {
if (new_head != NULL) {
|
if((result = cnd_wait(&condition, &lock)) != thrd_success) { cleanup_data_structure(new_head);
}
saved_old_head = old_head;
/* |
handle error... Reorganize the data structure ... */
} while (!(success |
}= atomic_compare_exchange_weak(
|
}
/*Resumewhenconditionholds*/
if((result=mtx_unlock(&lock)) != thrd_success) {
/* handle error */
}
}
ptr_to_head, &old_head, new_head
)) && old_head == saved_old_head);
return success; /* Exit the thread */
}
|
This loop could also be part of a larger control flow; for example, the thread from the noncompliant code example could be retried if it returns false
.
Compliant Solution (atomic_compare_exchange_strong()
)
When a weak compare-and-exchange would require a loop and a strong one would not, the strong one is preferable, as in this compliant solution:
Code Block |
---|
|
#include <stdatomic.h>
#include <stdbool.h>
struct data {
struct data *next;
/* ... */
};
extern void cleanup_data_structure(struct data *head);
int reorganize_data_structure(void *thread_arg) {
struct data *_Atomic *ptr_to_head = thread_arg;
struct data *old_head = atomic_load(ptr_to_head);
struct data *new_head;
bool success;
/* ... Reorganize the data structure ... */
success = atomic_compare_exchange_strong(
ptr_to_head, &old_head, new_head
);
if (!success) {
cleanup_data_structure(new_head);
}
return success; /* Exit the thread */
}
|
Risk Assessment
Failing to wrap the atomic_compare_exchange_weak()
and atomic_compare_exchange_weak_explicit()
functions in a loop can result in incorrect values and control flow
The notification mechanism notifies the waiting thread and allows it to check its condition predicate. The invocation of cnd_signal()
or cnd_broadcast()
in another thread cannot precisely determine which waiting thread will be resumed. Condition predicate statements allow notified threads to determine whether they should resume upon receiving the notification.
Both safety and liveness are concerns when using conditions. The safety property requires that all objects maintain consistent states in a multithreaded environment [Lea 2000]. The liveness property requires that every operation or function invocation execute to completion without interruption.
To guarantee liveness, programs must test the while
loop condition before invoking the cnd_wait()
function. This early test checks whether another thread has already satisfied the condition predicate and sent a notification. Invoking the cnd_wait()
function after the notification has been sent results in indefinite blocking.
To guarantee safety, programs must test the while
loop condition after returning from the cnd_wait()
function. Although cnd_wait()
is intended to block indefinitely until a notification is received, it must still be encased within a loop to prevent the following vulnerabilities [Bloch 2001]:
- Thread in the middle — A third thread can acquire the lock on the shared object during the interval between a notification being sent and the receiving thread resuming execution. This third thread can change the state of the object, leaving it inconsistent. This is a TOCTOU race condition.
- Malicious notification — A random or malicious notification can be received when the condition predicate is false. Such a notification would cancel the
cnd_wait()
. - Misdelivered notification — The order in which threads execute after receipt of a
cnd_broadcast()
signal is unspecified. Consequently, an unrelated thread could start executing and discover that its condition predicate is satisfied. Consequently, it could resume execution, although it was required to remain dormant.
For these reasons, programs must check the condition predicate after the cnd_wait()
function returns. A while
loop is the best choice for checking the condition predicate both before and after invoking cnd_ait()
.Noncompliant Code Example
This noncompliant code example invokes the cnd_wait()
function inside a traditional if
block and fails to check the postcondition after the notification is received. If the notification were accidental or malicious, the thread could wake up prematurely.
int result;
if ((result = mtx_lock(&lock)) != thrd_success) {
/* handle error */
} if (<condition does not hold>) {
if ((result = cnd_wait(&condition, &lock)) != thrd_success) {
/* handle error */
}
}
}
|
Compliant Solution
This compliant solution calls the cnd_wait()
function from within a while
loop to check the condition both before and after the call to cnd_wait()
.
int result;
if ((result = mtx_lock(&lock)) != thrd_success) {
/* handle error */
} while (<condition does not hold>) {
if ((result = cnd_wait(&condition, &lock)) != thrd_success) {
/* handle error */
}
}
}
|
Risk Assessment
Failure to encase the cnd_wait()
or cnd_timedwait()
functions inside a while
loop can lead to indefinite blocking and denial of service (DoS)Automated Detection
Tool | Version | Checker | Description |
---|
CodeSonar | | LANG.STRUCT.ICOL | Inappropriate Call Outside Loop |
Coverity | | BAD_CHECK_OF_WAIT_COND | Implemented |
Cppcheck Premium | Include Page |
---|
| Cppcheck Premium_V |
---|
| Cppcheck Premium_V |
---|
|
| premium-cert-con41-c | Partially implemented |
Helix QAC | | C2026 C++5023 |
|
Klocwork | | CERT.CONC.ATOMIC_COMP_FAIL_IN_LOOP |
|
Parasoft C/C++test | | CERT_C-CON41-a | Wrap functions that can fail spuriously in a loop |
Polyspace Bug Finder | Include Page |
---|
| Polyspace Bug Finder_V |
---|
| Polyspace Bug Finder_V |
---|
|
| CERT C: Rule CON41-C | Checks for situations where functions that can spuriously fail are not wrapped in loop (rule fully covered) |
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Key here (explains table format and definitions)
Bibliography
C11Section 26.3 Condition variable functions[Bloch 2001] | Item 50. Never invoke wait
outside a loop17.7.4, "The atomic_compare_exchange Generic Functions" |
[Lea 2000] | 1.3.2, "Liveness" 3.2.2, "Monitor Mechanics |
; 1.3.2, Liveness
Image Added Image Added Image AddedImage Removed Image Removed Image Removed