Page History

Mutexes Mutex objects are used to protect shared data structures from being concurrently accessed. If a mutex object is destroyed while a thread is blocked waiting for that mutexthe lock, critical sections ( and shared data that would otherwise be protected from data races) are no longer protected.

The C++ Standard, [thread.mutex.class], paragraph 5 [ISO/IEC 14882-2014], states the following:

The behavior of a program is undefined if it destroys a mutex object owned by any thread or a thread terminates while owning a mutex object.

This statement implies Similar wording exists for std::recursive_mutex, std::timed_mutex, std::recursive_timed_mutex, and std::shared_timed_mutex. These statements imply that destroying a mutex object while a thread is waiting on it is undefined behavior.

...

Unfortunately, this code contains a race condition, allowing the mutex to be destroyed before while it is unlockedstill owned, because start_threads() may invoke the lockmutex's destructor before all of the threads have finished using the lock.  This behavior is undefined.exited.

#include <mutex>
#include <thread>

const size_t max_threadsmaxThreads = 10;

void do_work(size_t i, std::mutex *lockppm)
 {
  std::lock_guard<std::mutex> guardlk(*lockppm);

  // Access data protected by the lock.
}

void start_threads(void)
 {
  std::thread threads[max_threadsmaxThreads];
  std::mutex lockm;

  for (size_t i = 0; i < max_threadsmaxThreads; ++i) {
    threads[i] = std::thread(do_work, i, &lockm);
  }
}

Compliant Solution

This compliant solution eliminates the race condition by extending the lifetime of the lock:mutex.

#include <mutex>
#include <thread>

const size_t max_threadsmaxThreads = 10;

void do_work(size_t i, std::mutex *lockppm)
 {
  std::lock_guard<std::mutex> guardlk(*lockppm);

  // Access data protected by the lock.
}

std::mutex lockm;

void start_threads(void)
 {
  std::thread threads[max_threadsmaxThreads];

  for (size_t i = 0; i < max_threadsmaxThreads; ++i) {
    threads[i] = std::thread(do_work, i, &lockm);
  }
}

Compliant Solution

This compliant solution eliminates the race condition by joining the threads before the lockmutex's destructor is invoked:.

#include <mutex>
#include <thread>

const size_t max_threadsmaxThreads = 10;

void do_work(size_t i, std::mutex *lockppm)
 {
  std::lock_guard<std::mutex> guardlk(*lockppm);

  // Access data protected by the lock.
}
void run_threads(void)
 {
  std::thread threads[max_threadsmaxThreads];
  std::mutex lockm;

  for (size_t i = 0; i < max_threadsmaxThreads; ++i) {
    threads[i] = std::thread(do_work, i, &lockm);
  }

  for (size_t i = 0; i < max_threadsmaxThreads; ++i) {
    threads[i].join();
  }
}

...

Destroying a mutex while it is locked may result in invalid control flow and data corruption.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Bibliography

...

Image Added Image Modified Image Removed  Image Modified