Page History

public final class ProcessStep implements Runnable {
  private static final Object lock = new Object();
  private static int time = 0;
  private final int step; // Do Perform operations when field time 
                          // reaches this value

  public ProcessStep(int step) {
    this.step = step;
  }

  @Override public void run() {
    try {
      synchronized (lock) {
        while (time != step) {
          lock.wait();
        }

        // Perform operations

        time++;
        lock.notify();
      }
    } catch (InterruptedException ie) {
      Thread.currentThread().interrupt(); // Reset interrupted status
    }
  }

  public static void main(String[] args) {
    for (int i = 4; i >= 0; i--) {
      new Thread(new ProcessStep(i)).start();
    }
  }
}

public final class ProcessStep implements Runnable {
  private static final Object lock = new Object();
  private static int time = 0;
  private final int step; // Perform operations when field time 
                          // reaches this value
  public ProcessStep(int step) {
    this.step = step;
  }

  @Override public void run() {
    try {
      synchronized (lock) {
        while (time != step) {
          lock.wait();
        }
  
        // Perform operations
  
        time++;
        lock.notifyAll(); // Use notifyAll() instead of notify()
      }
    } catch (InterruptedException ie) {
      Thread.currentThread().interrupt(); // Reset interrupted status
    }
  }

}

public class ProcessStep implements Runnable {
  private static final Lock lock = new ReentrantLock();
  private static final Condition condition = lock.newCondition();
  private static int time = 0;
  private final int step; // Perform operations when field time 
                          // reaches this value
  public ProcessStep(int step) {
    this.step = step;
  }

  @Override public void run() {
    lock.lock();
    try {
      while (time != step) {
        condition.await();
      }

      // Perform operations

      time++;
      condition.signal();
    } catch (InterruptedException ie) {
      Thread.currentThread().interrupt(); // Reset interrupted status
    } finally {
      lock.unlock();
    }
  }

  public static void main(String[] args) {
    for (int i = 4; i >= 0; i--) {
      new Thread(new ProcessStep(i)).start thread(s). These methods must be invoked from code that holds the same object lock as the waiting thread(s). The {{notifyAll()}} method wakes up all threads and allows threads whose condition predicate is true to resume execution. Furthermore, if all the threads whose condition predicate evaluates to true previously held a specific lock before going into the wait state, only one of them will reacquire the lock upon being notified. Presumably, the others will resume waiting.  The {{notify()}} method wakes up only one thread, making no guarantees as to which thread is notified. If the thread's condition predicate doesn't allow the thread to proceed, the chosen thread may resume waiting, defeating the purpose of the notification.

The {{notify()}} method may only be invoked if all the following conditions are met:
* Every condition predicate in every waiting thread would be true (condition expressions in loops will be false) if a notification were received by each, independently. Furthermore, all these threads must perform the same set of operations after waking up. In other words, any one thread can be selected to wake up and resume for a single invocation of {{notify()}}.
* Only one thread is required to wake up on the notify signal. This is contingent on the condition predicate, in that, only one predicate must fulfill the condition and allow the thread to proceed. Multiple condition predicates in the same statement should be avoided.
* No untrusted code has access to the object being waited on. If untrusted code has access to this object, it can invoke {{wait()}} on the object and intercept a {{notify()}} call.

The {{java.util.concurrent}} utilities (interface {{Condition}}) provide the {{signal()}} and {{signalAll()}} methods to awaken threads that are blocked on an {{await()}} call. Much like the {{notify()}} method, the {{signal()}} method wakes up only one of the threads that is waiting on the condition and consequently, may be insecure. It is always safer to use {{signalAll()}}. 

{mc} IMHO this stuff is related, but not necessary ~DS
 albeit a small performance penalty.  Similarly, if any thread is blocked on a {{wait()}} method invocation on a Java object which is being used as a condition queue, then that thread should be notified using {{notifyAll()}}. 
CON39-J. Do not synchronize on the intrinsic locks of high-level concurrency objects {mc}


h2. Noncompliant Code Example ({{notify()}})

This noncompliant code example shows a complex multi-step process being undertaken by several threads. Each thread executes one step of the process; the step being currently performed is indicated by the {{step}} field. Each thread waits for the {{step}} field to indicate that it is time to perform the corresponding thread's step. After performing the step, each thread increments {{step}} to transfer control to the next thread. The thread then notifies the thread that is responsible for the next step, and then the first thread exits.

{code:bgColor=#FFcccc}
public final class ProcessStep implements Runnable {
  private static final Object lock = new Object();
  private static int time = 0;
  private final int step; // Do operations when field time reaches this value

  public ProcessStep(int step) {
    this.step = step;
  }

  public void run() {
    try {
      synchronized (lock) {
        while (time != step) { 
          lock.wait();  
        }

        // ... Do operations

        time++;
        lock.notify();
      }
    } catch (InterruptedException ie) {
      Thread.currentThread().interrupt(); // Reset interrupted status
    }    
  }

  public static void main(String[] args) {
    for (int i = 4; i >= 0; i--) {
      new Thread(new ProcessStep(i)).start();
    }
  }
}
{code}

This noncompliant code example violates the [liveness|BB. Definitions#liveness] property. Each thread has a different condition predicate, as each requires {{step}} to have a different value before proceeding. The {{Object.notify()}} method wakes up only one thread at a time. Unless it happens to wake up the thread that is required to perform the next step, the program will deadlock and fail to make any progress.


h2. Compliant Solution ({{notifyAll()}})

In this compliant solution, all threads that have performed their own step use {{notifyAll()}} to notify other waiting threads. Consequently, the thread that is ready can perform its task, while all other threads whose condition predicates are false (loop condition expression is true), promptly resume waiting.

{code:bgColor=#ccccff}
  // ...
  public void run() {
    try {
      synchronized (lock) {
        while (time != step) { 
          lock.wait();  
        }

        // ... Do operations

        time++;
        lock.notifyAll();
      }
    } catch (InterruptedException ie) {
      Thread.currentThread().interrupt(); // Reset interrupted status
    }    
  }
{code}


h2. Noncompliant Code Example ({{Condition}} interface)

This noncompliant code example derives from the previous noncompliant code example but uses the {{Condition}} interface. The {{condition}} field allows the threads to wait on different condition predicates.

{code:bgColor=#FFcccc}
public class ProcessStep implements Runnable {
  private static final Lock lock = new ReentrantLock();
  private static final Condition condition = lock.newCondition();
  private static int time = 0;
  private final int step; // Do operations when field time reaches this value

  public ProcessStep(int step) {
    this.step = step;
  }

  public void run() {
    lock.lock();
    try {
      while (time != step) { 
        condition.await();  
      }

      // ... Do operations

      time++;
      condition.signal();
    } catch (InterruptedException ie) {
      Thread.currentThread().interrupt(); // Reset interrupted status
    } finally {
      lock.unlock();
    }
  }

  public static void main(String[] args) {
    for (int i = 4; i >= 0; i--) {
      new Thread(new ProcessStep(i)).start();
    }
  }
}
{code}

Similar to {{Object.notify()}}, the {{signal()}} method may choose any one thread and awaken it.  


h2. Compliant Solution ({{signalAll()}})

This compliant solution uses the {{signalAll()}} method to resume all the waiting threads whose condition predicate allows doing so.

{code:bgColor=#ccccff}
  // ...
  public void run() {
    lock.lock();
    try {
      while (time != step) { 
}

public class ProcessStep implements Runnable {
  private static final Lock lock = new ReentrantLock();
  private static final Condition condition = lock.newCondition();
  private static int time = 0;
  private final int step; // Perform operations when field time 
            condition.await();  
      }

      // ...reaches Dothis operations
value
  public ProcessStep(int   time++;step) {
    this.step = condition.signalAll()step;
    } catch (InterruptedException ie}

  @Override public void run() {
      Thread.currentThread().interruptlock.lock();
  // Reset interruptedtry status{
    } finally  while (time != step) {
        lockcondition.unlockawait();
      }
  }
{code}


h2. Compliant Solution   (unique Condition// perPerform thread)operations

This     compliant solutiontime++;
 assigns each thread its own condition, and makes all the {{Condition}} objects accessible to all the threads. 

{code:bgColor=#ccccff}
// Declare class as final because its constructor throws an exception 
public final class ProcessStep implements Runnable { 
  private static final Lock lock = new ReentrantLock.signalAll();
    } catch (InterruptedException ie) {
      Thread.currentThread().interrupt(); // Reset interrupted status
    } finally {
      lock.unlock();
  private static int}
  }

}

// Declare class as final because its constructor throws an exception
public final class ProcessStep implements Runnable {time = 0;
  private final int step; // Do operations when field time reaches this value
  private static final intLock MAX_STEPSlock = new 5ReentrantLock();
  private static final Condition[] conditionsint time = new Condition[MAX_STEPS]0;

  private publicfinal ProcessStep(int step); {
// Perform operations when if (step <= MAX_STEPS) {field time 
      this.step = step;
      conditions[step] = lock.newCondition();
    } else {
    // reaches throwthis new IllegalArgumentException("Too many threads");
    }
  }

  public void run() {
    lock.lock();
    tryvalue
  private static final int MAX_STEPS = 5;
  private static final Condition[] conditions = new Condition[MAX_STEPS];

  public ProcessStep(int step) {
      whileif (timestep !<= stepMAX_STEPS) { 
      this.step = conditions[step].await();
  
    conditions[step]  }

= lock.newCondition();
    } else {
 // ... Do operations

  throw new IllegalArgumentException("Too  time++many threads");
    }
  if}

 (step +@Override 1public < conditions.lengthvoid run() {
        conditions[step + 1].signallock.lock();
    try {
 }
    } catchwhile (InterruptedException ietime != step) {
        Thread.currentThread().interruptconditions[step].await();
 // Reset interrupted status
    }

 finally {
    //  lock.unlock();
Perform operations

      }time++;
  }

  public static voidif main(String[] args(step + 1 < conditions.length) {
    for (int i = MAX_STEPS - 1; i >= 0; i--) { conditions[step + 1].signal();
      }
    } catch ProcessStep(InterruptedException ms = new ProcessStep(i);
 ie) {
     new Thread.currentThread(ms).startinterrupt();
 // Reset interrupted }status
    }
}
{code}

Even thoughfinally {{signal()}} is used, it is guaranteed that only one thread will awaken because each condition predicate corresponds to a unique {{Condition}} variable. All threads perform the same operations. This compliant solution is only safe if untrusted code cannot create a thread with an instance of this class.


h2. Risk Assessment

Notifying a single thread instead of all waiting threads can pose a threat to the liveness property of the system.

|| Rule || Severity || Likelihood || Remediation Cost || Priority || Level ||
| CON19- J | low | unlikely | medium | {color:green}{*}P2{*}{color} | {color:green}{*}L3{*}{color} |



h3. Automated Detection

TODO



h3. Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the [CERT website|https://www.kb.cert.org/vulnotes/bymetric?searchview&query=FIELD+KEYWORDS+contains+CON32-J].

h2. References

\[[JLS 05|AA. Java References#JLS 05]\] [Chapter 17, Threads and Locks|http://java.sun.com/docs/books/jls/third_edition/html/memory.html]
\[[Goetz 06|AA. Java References#Goetz 06]\] Section 14.2.4, Notification
\[[Bloch 01|AA. Java References#Bloch 01]\] Item 50: Never invoke wait outside a loop

----
[!The CERT Sun Microsystems Secure Coding Standard for Java^button_arrow_left.png!|CON18-J. Always invoke wait() and await() methods inside a loop]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[!The CERT Sun Microsystems Secure Coding Standard for Java^button_arrow_up.png!|11. Concurrency (CON)]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[!The CERT Sun Microsystems Secure Coding Standard for Java^button_arrow_right.png!|CON20-J. Do not perform operations that may block while holding a lock]


      lock.unlock();
    }
  }

  public static void main(String[] args) {
    for (int i = MAX_STEPS - 1; i >= 0; i--) {
      ProcessStep ps = new ProcessStep(i);
      new Thread(ps).start();
    }
  }
}