The Object.wait() method is employed to temporarily cede cedes possession of a lock so that another thread other threads that may be requesting the lock can proceed. It Object.wait() must always be used inside called from a synchronized block . To resume activity, the other thread must notify the waiting thread. Moreover, the wait method should be invoked in or method. The waiting thread resumes execution only after it has been notified, generally as the result of the invocation of the notify() or notifyAll() method by some other thread. The wait() method must be invoked from a loop that checks if whether a condition predicate holds.
A condition statement is used so that the correct thread is notified since invocation of notify or notifyAll in another thread cannot pin point which waiting thread needs to be resumed. Another use is that sometimes a thread needs to block until a condition becomes true, for instance, when it cannot proceed without obtaining some data from a stream.
Note that a condition predicate is the negation of the condition expression in the loop. For example, the condition predicate for removing an element from a vector is !isEmpty(), whereas the condition expression for the while loop condition is isEmpty(). Following is the correct way to invoke the wait() method when the vector is empty.
| Code Block |
|---|
private Vector vector;
// ...
public void consumeElement() throws InterruptedException {
synchronized (vector) {
while (vector.isEmpty()) {
vector.wait();
|
| Code Block |
synchronized (object) { while (<condition does not hold>) { object.wait(); } //proceed Resume when condition holds } } |
Two properties come into picture here:
- Liveness: Every operation or method invocation executes to completion without interruptions, even if it goes against safety.
Wiki Markup Safety: Its main goal is to ensure that all objects maintain consistent states in a multi-threaded environment. \[[Lea 00|AA. Java References#Lea 00]\]
To guarantee liveness, the while loop condition should be tested before proceeding to invoke wait. This is because the condition might be true which indicates that a notify has already been sent from the other thread. Invoking wait after the notify has already been sent invites an infinite blocking state.
|
The notification mechanism notifies the waiting thread and allows it to check its condition predicate. The invocation of notify() or notifyAll() in another thread cannot precisely determine which waiting thread will be resumed. Condition predicate statements allow notified threads to determine whether they should resume upon receiving the notification. Condition predicates are also useful when a thread is required to block until a condition becomes true, for example, when waiting for data to arrive on an input stream before reading the data.
Both safety and liveness are concerns when using the wait/notify mechanism. The safety property requires that all objects maintain consistent states in a multithreaded environment [Lea 2000]. The liveness property requires that every operation or method invocation execute to completion without interruption.
To guarantee liveness, programs must test the while loop condition before invoking the wait() method. This early test checks whether another thread has already satisfied the condition predicate and sent a notification. Invoking the wait() method after the notification has been sent results in indefinite blocking.
To guarantee safety, programs must test the while loop condition after returning from the wait() method. Although wait() is intended to block indefinitely until a notification is received, it still must be encased within a loop to prevent the following vulnerabilities [Bloch 2001]:Wiki Markup
- Thread in the middle: A third thread can acquire the lock on the shared object during the interval between a notification being sent and the receiving thread actually resuming execution. This third thread can change the state of the object, leaving it inconsistent. This is akin to the "a time-of call-check, time-of-use " (TOCTOU) race condition.
- Malicious notifications: There is no guarantee that a notification will not be sent when the condition does not hold. This means that the invocation of
waitwill be nullified by the notification. - Sometimes on receipt of a
notifyAllsignal, an unrelated thread can start executing and it is possible for its condition to be true. - notification: A random or malicious notification can be received when the condition predicate is false. Such a notification would cancel the
wait()method. - Misdelivered notification: The order in which threads execute after receipt of a
notifyAll()signal is unspecified. Consequently, an unrelated thread could start executing and discover that its condition predicate is satisfied. Consequently, it could resume execution despite being required to remain dormant. - Spurious wakeups: Certain Java Virtual Machine (JVM) Certain JVM implementations are vulnerable to spurious wakeups , that result in waiting threads waking up even without a notification [API 2014].
Due to For these reasons, programs must check the condition predicate after the wait() method returns. A while loop is the best choice for checking the condition predicate both before and after invoking wait is called is indispensable().
Similarly, the await() method of the Condition interface also must be invoked inside a loop. According to the Java API [API 2014], Interface Condition
When waiting upon a Condition, a "spurious wakeup" is permitted to occur, in general, as a concession to the underlying platform semantics. This has little practical impact on most application programs as a Condition should always be waited upon in a loop, testing the state predicate that is being waited for. An implementation is free to remove the possibility of spurious wakeups but it is recommended that applications programmers always assume that they can occur and so always wait in a loop.
New code should use the java.util.concurrent.locks concurrency utilities in place of the wait/notify mechanism. However, legacy code that complies with the other requirements of this rule is permitted to depend on the wait/notify mechanism.
Noncompliant Code Example
This noncompliant code example invokes the wait() method inside a traditional if block and fails to check the post condition postcondition after the (accidental or malicious) notification is received. This means that the thread can waken when it is not supposed toIf the notification were accidental or malicious, the thread could wake up prematurely.
| Code Block | ||
|---|---|---|
| ||
synchronized (object) { if (<condition does not hold>) { object.wait(); } //proceed Proceed when condition holds } |
Compliant Solution
The This compliant solution encloses calls the wait() method in from within a while loop and as a result checks to check the condition during both pre and post wait invocation times.before and after the call to wait():
| Code Block | ||
|---|---|---|
| ||
//condition predicate is guarded by a lock on the shared object/variable synchronized (object) { while (<condition does not hold>) { object.wait(); } //proceed Proceed when condition holds } |
Invocations of the java.util.concurrent.locks.Condition.await() method also must be enclosed in a similar loop.
Risk Assessment
To guarantee liveness and safety, Failure to encase the wait() or await() method should always be called methods inside a while loop can lead to indefinite blocking and denial of service (DoS).
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|
THI03-J |
Low |
Unlikely |
Medium |
P??
P2 | L3 |
Automated Detection
...
TODO
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
| Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Parasoft Jtest |
| CERT.THI03.UWIL | Call 'wait()' and 'await()' only inside a loop that tests the liveness condition | ||||||
| SonarQube |
| S2274 | "Object.wait(...)" and "Condition.await(...)" should be called inside a "while" loop |
Bibliography
[API 2014] | |
Item 50, "Never Invoke | |
Section 14.2, "Using Condition Queues" | |
[Lea 2000] | Section 1.3.2, "Liveness" |
...
Wiki Markup