When a given thread waits (pthread_cond_wait() or pthread_cond_timedwait()) on a condition variable, it can be awakened as result of a signal operation (pthread_cond_signal()). However, if multiple threads are waiting on the same condition variable, any of those threads can be picked up by the scheduler to be woken up (assuming that all threads have the same priority level and also that they have only one mutex associated with the condition variable CON37-C. Do not use more than one mutex for concurrent waiting operations on a condition variable).
This forces the user to create a predicate-testing-loop around the wait to guarantee that each thread only executes if its predicate test is true (recommendation on IEEE Std 1003.1 since 2001 release). As a consequence, if a given thread finds the predicate test to be false, it waits again, eventually resulting in a deadlock situation.
Therefore, the use of pthread_cond_signal() is safe only if the following conditions are met:
- The condition variable is the same for each waiting thread;
- All threads must perform the same set of operations after waking up. This means that any thread can be selected to wake up and resume for a single invocation of
pthread_cond_signal(); - Only one thread is required to wake upon receiving the signal.
The use of pthread_cond_signal() can also be safe in the following situation:
- Each thread uses a unique condition variable;
- Each condition variable is associated with the same mutex (lock).
The use of pthread_cond_broadcast() solves the problem since it wakes up all the threads associated with the respective condition variable, and since all (must) re-evaluate the predicate condition, one should find its test to be true, avoiding the deadlock situation.
Noncompliant Code Example
#include <stdio.h>
#include <stdlib.h>
#include <pthread.h>
#define NTHREADS 10
pthread_mutex_t mutex;
pthread_cond_t cond;
void *run_step(void *t) {
static int time = 0;
int step = (int)t;
int result;
if ((result = pthread_mutex_lock(&mutex)) != 0) {
/* Handle error condition */
}
printf("Thread %d has the lock\n", step);
while (time != step) {
printf("Thread %d is sleeping...\n", step);
if ((result = pthread_cond_wait(&cond, &mutex)) != 0) {
/* Handle error condition */
}
printf("Thread %d woke up\n", step);
}
/* Do processing... */
printf("Thread %d is processing...\n", step);
time++;
/* Signal waiting tasks */
if ((result = pthread_cond_signal(&cond)) != 0) {
/* Handle error condition */
}
printf("Thread %d is exiting...\n", step);
if ((result = pthread_mutex_unlock(&mutex)) != 0) {
/* Handle error condition */
}
pthread_exit(NULL);
}
int main(int argc, char** argv) {
int i;
int result;
pthread_attr_t attr;
pthread_t threads[NTHREADS];
int step[NTHREADS];
if ((result = pthread_mutex_init(&mutex, NULL)) != 0) {
/* Handle error condition */
}
if ((result = pthread_cond_init(&cond, NULL)) != 0) {
/* Handle error condition */
}
if ((result = pthread_attr_init(&attr)) != 0) {
/* Handle error condition */
}
if ((result = pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_JOINABLE)) != 0) {
/* Handle error condition */
}
/* Create threads */
for (i=0; i<NTHREADS; i++) {
step[i] = i;
if ((result = pthread_create(&threads[i], &attr, run_step, (void *)step[i])) != 0) {
/* Handle error condition */
}
}
/* Wait for all threads to complete */
for (i = NTHREADS-1; i >= 0; i--) {
if ((result = pthread_join(threads[i], NULL)) != 0) {
/* Handle error condition */
}
}
if ((result = pthread_mutex_destroy(&mutex)) != 0) {
/* Handle error condition */
}
if ((result = pthread_cond_destroy(&cond)) != 0) {
/* Handle error condition */
}
if ((result = pthread_attr_destroy(&attr)) != 0) {
/* Handle error condition */
}
pthread_exit(NULL);
}
Risk Assessment
Signal a single thread instead of all waiting threads can pose a threat to the liveness property of the system.
Guideline |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
|---|---|---|---|---|---|
CON38-C |
low |
unlikely |
medium |
P2 |
L3 |
pthread_cond_wait() and pthread_cond_timedwait() take a condition variable and locked mutex as arguments. These functions unlock the mutex until the condition variable is signaled and then re-lock the mutex before returning. While a thread is waiting on a particular condition variable and mutex, other threads may only wait on the same condition variable if they also pass the same mutex as an argument. This requirement is noted in the Open Group Base Specifications Issue 6:
...as long as at least one thread is blocked on the condition variable. During this time, the effect of an attempt by any thread to wait on that condition variable using a different mutex is undefined.
It also specifies that pthread_cond_wait() “may†fail if:
[EINVAL]
The value specified by cond or mutex is invalid.
[EPERM]
The mutex was not owned by the current thread at the time of the call.
Noncompliant Code Example
In this noncompliant code example, mutex1 protects count1 and mutex2 protects count2. A race condition exists between the waiter1 and waiter2 threads since they use the same condition variable with different mutexes. If both threads attempt to call pthread_cond_wait() at the same time, one thread will succeed and the other thread will invoke undefined behavior.
#include <stdio.h>
#include <string.h>
#include <pthread.h>
#include <assert.h>
#include <unistd.h>
#include <errno.h>
pthread_mutex_t mutex1;
pthread_mutex_t mutex2;
pthread_mutexattr_t attr;
pthread_cond_t cv;
void *waiter1();
void *waiter2();
void *signaler();
int count1 = 0, count2 = 0;
#define COUNT_LIMIT 5
int main() {
int ret;
pthread_t thread1, thread2, thread3;
if ((ret = pthread_mutexattr_init( &attr)) != 0) {
/* handle error */
}
if ((ret = pthread_mutexattr_settype( &attr, PTHREAD_MUTEX_ERRORCHECK)) != 0) {
/* handle error */
}
if ((ret = pthread_mutex_init( &mutex1, &attr)) != 0) {
/* handle error */
}
if ((ret = pthread_mutex_init( &mutex2, &attr)) != 0) {
/* handle error */
}
if ((ret = pthread_cond_init( &cv, NULL)) != 0) {
/* handle error */
}
if ((ret = pthread_create( &thread1, NULL, &waiter1, NULL))) {
/* handle error */
}
if ((ret = pthread_create( &thread2, NULL, &waiter2, NULL))) {
/* handle error */
}
if ((ret = pthread_create( &thread3, NULL, &signaler, NULL))) {
/* handle error */
}
if ((ret = pthread_join( thread1, NULL)) != 0) {
/* handle error */
}
if ((ret = pthread_join( thread2, NULL)) != 0) {
/* handle error */
}
if ((ret = pthread_join( thread3, NULL)) != 0) {
/* handle error */
}
return 0;
}
void *waiter1() {
int ret;
while (count1 < COUNT_LIMIT) {
if ((ret = pthread_mutex_lock(&mutex1)) != 0) {
/* handle error */
}
if ((ret = pthread_cond_wait(&cv, &mutex1)) != 0) {
/* handle error */
}
printf("count1 = %d\n", ++count1);
if ((ret = pthread_mutex_unlock(&mutex1)) != 0) {
/* handle error */
}
}
return NULL;
}
void *waiter2() {
int ret;
while (count2 < COUNT_LIMIT) {
if ((ret = pthread_mutex_lock(&mutex2)) != 0) {
/* handle error */
}
if ((ret = pthread_cond_wait(&cv, &mutex2)) != 0) {
/* handle error */
}
printf("count2 = %d\n", ++count2);
if ((ret = pthread_mutex_unlock(&mutex2)) != 0) {
/* handle error */
}
}
return NULL;
}
void *signaler() {
int ret;
while ((count1 < COUNT_LIMIT) || (count2 < COUNT_LIMIT)) {
sleep(1);
printf("signaling\n");
if ((ret = pthread_cond_signal(&cv)) != 0) {
/* handle error */
}
}
return NULL;
}
Implementation Details: Linux
When the system is built on the following platform:
Red Hat Enterprise Linux Client release 5.5 (Tikanga)
kernel 2.6.18
gcc 4.3.5 with the --D_GNU_SOURCE flag
the above code works as expected. Waiter1 and waiter2 increment the variable once they are signaled and the correct mutex is acquired after pthread_cond_wait returns in each thread.
The man page for pthread_cond_wait on this configuration says that it “may†fail with a return value of EINVAL if “different mutexes were supplied for concurrent pthread_cond_timedwait() or pthread_cond_wait() operations on the same condition variable.†This does not happen however.
Implementation Details: OS X
When the system is built on the following platform:
OS X 10.6.4 (Snow Leopard)
gcc 4.2.1
pthread_cond_wait() returns EINVAL if it is called when another thread is waiting on the condition variable with a different mutex. This is arguably better since it forces the coder to fix the problem instead of allowing reliance on undefined behavior.
The man page for pthread_cond_wait()}] simply says that {{EINVAL will be returned if “The value specified by cond or the value specified by mutex is invalid.†but it doesn’t say what invalid means.
Compliant Solution
This problem can be solved either by always using the same mutex whenever a particular condition variable is used, or by using separate condition variables. Which one is better depends on how the code is expected to work. Here we will use the “same mutex†solution.
pthread_mutex_t mutex1; /* initialized as PTHREAD_MUTEX_ERRORCHECK */
pthread_cond_t cv;
int count1 = 0, count2 = 0;
void *waiter1() {
int ret;
while (count1 < COUNT_LIMIT) {
if ((ret = pthread_mutex_lock(&mutex1)) != 0) {
/* handle error */
}
if ((ret = pthread_cond_wait(&cv, &mutex1)) != 0) {
/* handle error */
}
printf("count1 = %d\n", ++count1);
if ((ret = pthread_mutex_unlock(&mutex1)) != 0) {
/* handle error */
}
}
return NULL;
}
void *waiter2() {
int ret;
while (count2 < COUNT_LIMIT) {
if ((ret = pthread_mutex_lock(&mutex1)) != 0) {
/* handle error */
}
if ((ret = pthread_cond_wait(&cv, &mutex1)) != 0) {
/* handle error */
}
printf("count2 = %d\n", ++count2);
if ((ret = pthread_mutex_unlock(&mutex1)) != 0) {
/* handle error */
}
}
return NULL;
}
Risk Assessment
Waiting on the same condition variable with two different mutexes could cause a thread to be signaled and resume execution with the wrong mutex locked. This could lead to unexpected program behavior if the same shared data were simultaneously accessed by two threads.
Therefore the severity is medium because improperly accessing shared data could lead to data integrity violation. Likelihood is probable because in such an implementation an error code would not be returned, and remediation cost is high because detection and correction of this problem are both manual.
Rule |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
|---|---|---|---|---|---|
CON37-C |
medium |
probable |
high |
P4 |
L3 |
Bibliography
[Open Group 2004] pthread_cond_timedwait()/pthread_cond_wait()