CON19-J. Notify all waiting threads instead of a single thread

A thread that invokes wait() expects to wake up and resume execution when its [condition predicate] becomes true. Waiting threads must test their condition predicates upon receiving notifications and resume waiting if they are false to be compliant with [CON18-J. Always invoke wait() and await() methods inside a loop].

The notify() and notifyAll() methods of package java.lang.Object are used to wake up waiting thread(s). These methods must be invoked from code that holds the same object lock as the waiting thread(s). An IllegalMonitorStateException is thrown if the current thread is not the owner of this object's monitor. The notifyAll() method wakes up all threads and allows threads whose condition predicate is true to resume execution. Furthermore, if all the threads whose condition predicate evaluates to true previously held a specific lock before going into the wait state, only one of them will reacquire the lock upon being notified. Presumably, the other threads will resume waiting. The notify() method wakes up only one thread and makes no guarantees as to which thread is notified. If the thread's condition predicate doesn't allow the thread to proceed, the chosen thread may resume waiting, defeating the purpose of the notification.

The notify() method may only be invoked if all the following conditions are met:

• The condition predicate is identical for each waiting thread.
• All threads must perform the same set of operations after waking up. In other words, any one thread can be selected to wake up and resume for a single invocation of notify().
• Only one thread is required to wake upon the notification.

These threads are often identical and provide a stateless service or utility.

The java.util.concurrent utilities (interface Condition) provide the signal() and signalAll() methods to awaken threads that are blocked on an await() call. The programmer must ensure the liveness property when using signal() and signalAll().

Noncompliant Code Example (notify())

This noncompliant code example shows a complex multi-step process being undertaken by several threads. Each thread executes one step of the process; the step being currently performed is indicated by the time field. Each thread waits for the time field to indicate that it is time to perform the corresponding thread's step. After performing the step, each thread increments time to transfer control to the next thread. The thread then notifies the thread that is responsible for the next step and exits.

public final class ProcessStep implements Runnable {
  private static final Object lock = new Object();
  private static int time = 0;
  private final int step; // Do operations when field time reaches this value

  public ProcessStep(int step) {
    this.step = step;
  }

  @Override public void run() {
    try {
      synchronized (lock) {
        while (time != step) { 
          lock.wait();  
        }

        // Perform operations

        time++;
        lock.notify();
      }
    } catch (InterruptedException ie) {
      Thread.currentThread().interrupt(); // Reset interrupted status
    }    
  }

  public static void main(String[] args) {
    for (int i = 4; i >= 0; i--) {
      new Thread(new ProcessStep(i)).start();
    }
  }
}

This noncompliant code example violates the [liveness] property. Each thread has a different condition predicate, as each requires step to have a different value before proceeding. The Object.notify() method wakes up only one thread at a time. Unless it happens to wake up the thread that is required to perform the next step, the program will deadlock.

Compliant Solution (notifyAll())

In this compliant solution, each thread completes its step then calls notifyAll() to notify the waiting threads. The thread that is ready can perform its task, while all the threads whose condition predicates are false (loop condition expression is true) promptly resume waiting.

Only the run() method from the noncompliant code example is modified as follows:

@Override public void run() {
  try {
    synchronized (lock) {
      while (time != step) { 
        lock.wait();  
      }

      // Perform operations

      time++;
      lock.notifyAll(); // Use notifyAll() instead of notify()
    }
  } catch (InterruptedException ie) {
    Thread.currentThread().interrupt(); // Reset interrupted status
  }    
}

Noncompliant Code Example (Condition interface)

This noncompliant code example is similar to the noncompliant code example for notify() but uses the Condition interface for waiting and notification.

public class ProcessStep implements Runnable {
  private static final Lock lock = new ReentrantLock();
  private static final Condition condition = lock.newCondition();
  private static int time = 0;
  private final int step; // Do operations when field time reaches this value

  public ProcessStep(int step) {
    this.step = step;
  }

  public void run() {
    lock.lock();
    try {
      while (time != step) { 
        condition.await();  
      }

      // Perform operations

      time++;
      condition.signal();
    } catch (InterruptedException ie) {
      Thread.currentThread().interrupt(); // Reset interrupted status
    } finally {
      lock.unlock();
    }
  }

  public static void main(String[] args) {
    for (int i = 4; i >= 0; i--) {
      new Thread(new ProcessStep(i)).start();
    }
  }
}

Similar to Object.notify(), the signal() method may awaken an arbitrary thread.

Compliant Solution (signalAll())

This compliant solution uses the signalAll() method to notify all waiting threads. Before await() returns the current thread reacquires the lock associated with this condition. When the thread returns it is guaranteed to hold this lock [[API 06]]

. The thread that is ready can perform its task, while all the threads whose condition predicates are false resume waiting.

Only the run() method from the noncompliant code example is modified as follows:

  public void run() {
    lock.lock();
    try {
      while (time != step) { 
        condition.await();  
      }

      // Perform operations

      time++;
      condition.signalAll();
    } catch (InterruptedException ie) {
      Thread.currentThread().interrupt(); // Reset interrupted status
    } finally {
      lock.unlock();
    }
  }

Compliant Solution (Unique Condition Per Thread)

This compliant solution assigns each thread its own condition. All the Condition objects are accessible to all the threads.

// Declare class as final because its constructor throws an exception 
public final class ProcessStep implements Runnable { 
  private static final Lock lock = new ReentrantLock();
  private static int time = 0;
  private final int step; // Do operations when field time reaches this value
  private static final int MAX_STEPS = 5;
  private static final Condition[] conditions = new Condition[MAX_STEPS];

  public ProcessStep(int step) {
    if (step <= MAX_STEPS) {
      this.step = step;
      conditions[step] = lock.newCondition();
    } else {
      throw new IllegalArgumentException("Too many threads");
    }
  }

  @Override public void run() {
    lock.lock();
    try {
      while (time != step) { 
        conditions[step].await();  
      }

      // Perform operations

      time++;
      if (step + 1 < conditions.length) {
        conditions[step + 1].signal();
      }
    } catch (InterruptedException ie) {
      Thread.currentThread().interrupt(); // Reset interrupted status
    } finally {
      lock.unlock();
    }
  }

  public static void main(String[] args) {
    for (int i = MAX_STEPS - 1; i >= 0; i--) {
      ProcessStep ps = new ProcessStep(i);
      new Thread(ps).start();
    }
  }
}

Even though signal() is used, only the thread whose condition predicate corresponds to the unique Condition variable will awaken. All threads perform the same set of operations upon waking up.

This compliant solution is only safe if untrusted code cannot create a thread with an instance of this class.

Risk Assessment

Notifying a single thread instead of all waiting threads can pose a threat to the liveness property of the system.

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

[[API 06]] java.util.concurrent.locks.Condition interface
[[JLS 05]] Chapter 17, Threads and Locks
[[Goetz 06]] Section 14.2.4, Notification
[[Bloch 01]] Item 50: Never invoke wait outside a loop

[!The CERT Sun Microsystems Secure Coding Standard for Java^button_arrow_left.png!]      [!The CERT Sun Microsystems Secure Coding Standard for Java^button_arrow_up.png!]      [!The CERT Sun Microsystems Secure Coding Standard for Java^button_arrow_right.png!]