SEI CERT C Coding Standard

Space shortcuts

Page tree

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 54 Next »

Mutexes are often used to prevent multiple threads from accessing critical resources at the same time. Sometimes, when locking mutexes, multiple threads hold each other's lock, and the program consequently deadlocks. There are four requirements for deadlock:

  • mutual exclusion
  • hold and wait
  • no preemption
  • circular wait

Deadlock requires all four conditions, so, to prevent deadlock, prevent any one of the four conditions. This guideline recommends locking the mutexes in a predefined order to prevent circular wait.

Noncompliant Code Example

The following code has behavior that depends on the runtime environment and the platform's scheduler. However, with proper timing, the main() function will deadlock when running thr1 and thr2, where thr1 tries to lock ba2's mutex, while thr2 tries to lock on ba1's mutex in the deposit() function, and the program will not progress.

typedef struct {
  int balance;
  mtx_t balance_mutex;
} bank_account;

typedef struct {
  bank_account *from;
  bank_account *to;
  int amount;
} deposit_thr_args;

void create_bank_account(bank_account **ba, int initial_amount) {
  int result;
  bank_account *nba = malloc(sizeof(bank_account));
  if (nba == NULL) {
    /* Handle Error */
  }

  nba->balance = initial_amount;
  result = mtx_init(&nba->balance_mutex, mtx_plain);
  if (result == thrd_error) {
    /* Handle Error */
  }

  *ba = nba;
}


void *deposit(void *ptr) {
  int result;
  deposit_thr_args *args = (deposit_thr_args *)ptr;

  if ((result = mtx_lock(&(args->from->balance_mutex))) != thrd_success) {
    /* Handle Error */
  }

  /* not enough balance to transfer */
  if (args->from->balance < args->amount) {
    if ((result = mtx_unlock(&(args->from->balance_mutex))) != thrd_success) {
      /* Handle Error  */
    }
    return NULL;
  }

  if ((result = mtx_lock(&(args->to->balance_mutex))) != thrd_success) {
    /* Handle Error */
  }

  args->from->balance -= args->amount;
  args->to->balance += args->amount;

  if ((result = mtx_unlock(&(args->from->balance_mutex))) != thrd_success) {
    /* Handle Error */
  }
  if ((result = mtx_unlock(&(args->to->balance_mutex))) != thrd_success) {
    /* Handle Error */
  }


  free(ptr);
  return NULL;
}


int main(void) {

  pthread_t thr1, thr2;
  int result;

  bank_account *ba1;
  bank_account *ba2;
  create_bank_account(&ba1, 1000);
  create_bank_account(&ba2, 1000);

  deposit_thr_args *arg1 = malloc(sizeof(deposit_thr_args));
  if (arg1 == NULL) {
    /* Handle Error */
  }
  deposit_thr_args *arg2 = malloc(sizeof(deposit_thr_args));
  if (arg2 == NULL) {
    /* Handle Error */
  }

  arg1->from = ba1;
  arg1->to = ba2;
  arg1->amount = 100;

  arg2->from = ba2;
  arg2->to = ba1;
  arg2->amount = 100;

  /* perform the deposits */
  if ((result = thrd_create(&thr1, deposit, (void *)arg1)) != thrd_success) {
    /* Handle Error */
  }
  if ((result = thrd_create(&thr2, deposit, (void *)arg2)) != thrd_success) {
    /* Handle Error */
  }

  thrd_exit(NULL);
  return 0;
}

Compliant Solution

The solution to the deadlock problem is to use a predefined order for the locks in the deposit() function. In the following compliant solution, each thread will lock based on the id of bank_account, defined in the struct initialization. This prevents the circular wait problem.

typedef struct {
  int balance;
  mtx_t balance_mutex;
  unsigned int id; /* should never be changed after initialized */
} bank_account;

unsigned int global_id = 1;

void create_bank_account(bank_account **ba, int initial_amount) {
  int result;
  bank_account *nba = malloc(sizeof(bank_account));
  if (nba == NULL) {
    /* Handle Error */
  }

  nba->balance = initial_amount;
  result = mtx_init(&nba->balance_mutex, mtx_plain);
  if (result != thrd_success) {
    /* Handle Error */
  }

  nba->id = global_id++;
  *ba = nba;
}


void *deposit(void *ptr) {
  deposit_thr_args *args = (deposit_thr_args *)ptr;
  int result;

  if (args->from->id == args->to->id)
		return;

  /* ensure proper ordering for locking */
  if (args->from->id < args->to->id) {
    if ((result = mtx_lock(&(args->from->balance_mutex))) != thrd_success) {
      /* Handle Error */
    }
    if ((result = mtx_lock(&(args->to->balance_mutex))) != thrd_success) {
      /* Handle Error */
    }
  } else {
    if ((result = mtx_lock(&(args->to->balance_mutex))) != thrd_success) {
      /* Handle Error */
    }
    if ((result = mtx_lock(&(args->from->balance_mutex))) != thrd_success) {
      /* Handle Error */
    }
  }

  /* not enough balance to transfer */
  if (args->from->balance < args->amount) {
    if ((result = mtx_unlock(&(args->from->balance_mutex))) != thrd_success) {
      /* Handle Error */
    }
    if ((result = mtx_unlock(&(args->to->balance_mutex))) != thrd_success) {
      /* Handle Error */
    }
    return;
  }

  args->from->balance -= args->amount;
  args->to->balance += args->amount;

  if ((result = mtx_unlock(&(args->from->balance_mutex))) != thrd_success) {
    /* Handle Error */
  }
  if ((result = mtx_unlock(&(args->to->balance_mutex))) != thrd_success) {
    /* Handle Error */
  }


  free(ptr);
  return;
}

Risk Assessment

Deadlock prevents multiple threads from progressing, thus halting the executing program. This is a potential denial-of-service attack because the attacker can force deadlock situations. Deadlock is likely to occur in multithreaded programs that manage multiple shared resources.

Recommendation

Severity

Likelihood

Remediation Cost

Priority

Level

CON35-C

low

probable

medium

P4

L3

Related Guidelines

The CERT Oracle Secure Coding Standard for Java: LCK07-J. Avoid deadlock by requesting and releasing locks in the same order

MITRE CWE: CWE-764] Multiple Locks of Critical Resources

Bibliography

[Barney 2010] pthread_mutex tutorial
[Bryant 2003] Chapter 13, Concurrent Programming

  • No labels