To avoid data corruption in multithreaded Java programs, shared data must be protected from concurrent modifications and accesses. This can be performed at the object level by using synchronized methods or blocks, or by using dynamic lock objects. However, excessive use of locking may result in deadlocks (See CON08-J. Do not call alien methods that synchronize on the same objects as any callers in the execution chain).
"The Java programming language neither prevents nor requires detection of deadlock conditions." [[JLS 05]]. Deadlocks can arise when two or more threads request and release locks in different orders. Consequently, to avoid deadlock, locks should be acquired and released in the same order and synchronization should be limited to where it is absolutely necessary. For instance, to avoid deadlocks in an applet, the paint(), dispose(), stop(), and destroy() methods should not be synchronized because they are always called and used from dedicated threads.
Deadlocks can also arise when two or more threads are waiting for each other to release resources such as database connections. The advice of this guideline also applies to these cases.
Noncompliant Code Example
This noncompliant code example can deadlock because of excessive synchronization. Assume that an attacker has two bank accounts and is capable of requesting two depositAmount() operations in succession, one each from the two threads started in main().
class BankAccount {
private double balanceAmount; // Total amount in bank account
private BankAccount(double balance) {
this.balanceAmount = balance;
}
// Deposits the amount from this object instance to BankAccount instance argument ba
private void depositAmount(BankAccount ba, double amount) {
synchronized (this) {
synchronized(ba) {
if(amount > balanceAmount) {
throw new IllegalArgumentException("Transfer cannot be completed");
}
ba.balanceAmount += amount;
this.balanceAmount -= amount;
}
}
}
public static void initiateTransfer(final BankAccount first,
final BankAccount second, final double amount) {
Thread t = new Thread(new Runnable() {
public void run() {
first.depositAmount(second, amount);
}
});
t.start();
}
}
Objects of class BankAccount represent bank accounts. The balanceAmount field represents the total balance amount available for a particular object (bank account). A user is allowed to initiate an operation deposit amount that atomically transfers a specified amount from one account to another.
Objects of this class are deadlock-prone. An attacker may cause the program to construct two threads that initiate balance transfers from two different BankAccount object instances, a and b. Consider the following code that does this:
BankAccount a = new BankAccount(5000); BankAccount b = new BankAccount(6000); initiateTransfer(a, b, 1000); // starts thread 1 initiateTransfer(b, a, 1000); // starts thread 2
The two transfers are performed in their own threads, from instance a to b and b to a. The first thread atomically transfers the amount from a to b by depositing it in account b and then withdrawing the same amount from a. The second thread performs the reverse operation, that is, it transfers the balance from b to a. When executing depositAmount(), the first thread acquires a lock on object a. It is possible for the second thread to acquire a lock on object b before the first thread can lock on b. Subsequently, the first thread would request a lock on b which is already held by the second thread. The second thread would request a lock on a which is already held by the first thread. This constitutes a deadlock condition, as neither thread can proceed.
This example may or may not deadlock depending on the scheduling details of the platform. Deadlock can occur when two threads request the same two locks in different orders and each thread obtains a lock that prevents the other thread from completing its transfer. Deadlock might not occur when two threads request the same two locks, but one thread completes its transfer before the other thread begins. Deadlock also cannot occur if the two threads request the same two locks in the same order (which would happen if they both transfer money from one account to a second account), or if two simultaneous transfers occur involving distinct accounts.
Compliant Solution (static internal private lock)
The deadlock can be avoided by using a private static final internal lock object before performing any account transfers.
class BankAccount {
private double balanceAmount; // Total amount in bank account
private static final Object lock = new Object();
private BankAccount(double balance) {
this.balanceAmount = balance;
}
// Deposits the amount from this object instance to BankAccount instance argument ba
private void depositAmount(BankAccount ba, double amount) {
synchronized (lock) {
if (amount > balanceAmount) {
throw new IllegalArgumentException("Transfer cannot be completed");
}
ba.balanceAmount += amount;
this.balanceAmount -= amount;
}
}
public static void initiateTransfer(final BankAccount first,
final BankAccount second, final double amount) {
Thread t = new Thread(new Runnable() {
public void run() {
first.depositAmount(second, amount);
}
});
t.start();
}
}
In this scenario, if two threads with two different BankAccount objects try to transfer to each others' accounts simultaneously, deadlock cannot occur. One thread will acquire the private lock, complete its transfer, and release the lock, before the other thread can proceed.
This solution comes with a performance penalty because a private static lock restricts the system to performing only one transfer at a time. Two transfers involving four distinct accounts (with distinct target accounts) may not happen concurrently. The impact of this penalty increases considerably as the number of BankAccount objects increase. Consequently, this solution does not scale very well.
Compliant Solution (ordered locks)
This compliant solution ensures that multiple locks are acquired and released in the same order. It requires that an ordering over BankAccount objects is available. The ordering is enforced by having the class BankAccount implement the java.lang.Comparable interface and overriding the compareTo() method.
class BankAccount implements Comparable<BankAccount> {
private double balanceAmount; // Total amount in bank account
private final Object lock;
private final long id; // Unique for each BankAccount
private static long nextID = 0; // Next unused id
private BankAccount(double balance) {
this.balanceAmount = balance;
this.lock = new Object();
this.id = this.nextID++;
}
public int compareTo(BankAccount ba) {
if (this.id < ba.id) {
return -1;
}
if (this.id > ba.id) {
return 1;
}
return 0;
}
// Deposits the amount from this object instance to BankAccount instance argument ba
private void depositAmount(BankAccount ba, double amount) {
BankAccount former, latter;
if (compareTo(ba) < 0) {
former = this;
latter = ba;
} else {
former = ba;
latter = this;
}
synchronized (former) {
synchronized (latter) {
if (amount > balanceAmount) {
throw new IllegalArgumentException("Transfer cannot be completed");
}
ba.balanceAmount += amount;
this.balanceAmount -= amount;
}
}
}
public static void initiateTransfer(final BankAccount first,
final BankAccount second, final double amount) {
Thread t = new Thread(new Runnable() {
public void run() {
first.depositAmount(second, amount);
}
});
t.start();
}
}
Whenever a transfer occurs, the two BankAccount objects are ordered so that the first object's lock is acquired before the second object's lock. Consequently, if two threads attempt transfers between the same two accounts, they will both try to acquire the first account's lock before the second account's lock, with the result that one thread will acquire both locks, complete the transfer, and release both locks before the other thread may proceed.
Unlike the previous compliant solution, this solution incurs no performance penalty because multiple transfers can occur concurrently as long as the transfers involve distinct target accounts.
Compliant Solution (ReentrantLock)
In this compliant solution, each BankAccount has a java.util.concurrent.locks.ReentrantLock associated with it. This permits the depositAmount() method to try acquiring both accounts' locks, but releasing the locks if it fails, and trying again later.
class BankAccount {
private double balanceAmount; // Total amount in bank account
private final Lock lock = new ReentrantLock();
private final Random number = new Random(123L);
private BankAccount(double balance) {
this.balanceAmount = balance;
}
// Deposits the amount from this object instance to BankAccount instance argument ba
private void depositAmount(BankAccount ba, double amount) throws InterruptedException {
while (true) {
if (this.lock.tryLock()) {
try {
if (ba.lock.tryLock()) {
try {
if (amount > balanceAmount) {
throw new IllegalArgumentException("Transfer cannot be completed");
}
ba.balanceAmount += amount;
this.balanceAmount -= amount;
break;
} finally {
ba.lock.unlock();
}
}
} finally {
this.lock.unlock();
}
}
int n = number.nextInt(1000);
int TIME = 1000 + n; // 1 second + random delay to prevent livelock
Thread.sleep(TIME);
}
}
public static void initiateTransfer(final BankAccount first,
final BankAccount second, final double amount) {
Thread t = new Thread(new Runnable() {
public void run() {
try {
first.depositAmount(second, amount);
} catch (InterruptedException e) {
Thread.currentThread().interrupt(); // Reset interrupted status
}
}
});
t.start();
}
}
Deadlock is impossible in this compliant solution because no method grabs a lock and holds it indefinitely. If the current object's lock is acquired, but the the second lock is unavailable, the first lock is released and the thread sleeps for some specified time before retrying.
Code that uses this lock behaves similar to synchronized code that uses the traditional monitor lock. ReentrantLock provides several other capabilities, for instance, the tryLock() method does not block waiting if another thread is already holding the lock. The class java.util.concurrent.locks.ReentrantReadWriteLock can be used when some thread requires a lock to write information while other threads require the lock to concurrently read the information.
Noncompliant Code Example
Consider an immutable class WebRequest that encapsulates a web request to a server.
// Immutable WebRequest
public final class WebRequest {
private final long bandwidth;
private final long responseTime;
public WebRequest(long bandwidth, long responseTime) {
this.bandwidth = bandwidth;
this.responseTime = responseTime;
}
public long getBandwidth() {
return bandwidth;
}
public long getResponseTime() {
return responseTime;
}
}
Each request has a response time associated with it, as well as a measurement of network bandwidth required to fulfill the request.
This noncompliant code example consists of an application that monitors web requests. It calculates the average bandwidth and average response time required to service all incoming requests.
public class WebRequestAnalyzer {
private final Vector<WebRequest> requests = new Vector<WebRequest>();
public boolean addWebRequest(WebRequest request) {
// Lock on last element to prevent data race with the calculateAverageResponseTime() method
synchronized (requests.lastElement()) {
// Defensive copying
return requests.add(new WebRequest(request.getBandwidth(), request.getResponseTime()));
}
}
public double getAverageBandwidth() {
return calculateAverageBandwidth(0, 0);
}
public double getAverageResponseTime() {
return calculateAverageResponseTime(requests.size() - 1, 0);
}
private double calculateAverageBandwidth(int i, long bandwidth) {
if (i > requests.size()) {
return bandwidth / requests.size();
}
synchronized (requests.elementAt(i)) {
bandwidth += requests.get(i).getBandwidth();
return calculateAverageBandwidth(++i, bandwidth); // Acquires locks in increasing order
}
}
private double calculateAverageResponseTime(int i, long responseTime) {
if (i <= -1) {
return responseTime / requests.size();
}
synchronized (requests.elementAt(i)) {
responseTime += requests.get(i).getResponseTime();
return calculateAverageResponseTime(--i, responseTime); // Acquires locks in decreasing order
}
}
}
The monitoring application is built upon class WebRequestAnalyzer that maintains a list of web requests using vector requests. The vector requests is suitably initialized after defensively copying the requests. Any thread can get the average bandwidth or average response time of all web requests by invoking the getAverageBandwidth() and getAverageResponseTime() methods.
These methods use fine-grained locking by holding locks on individual elements (requests) of the vector. The locks permit new requests to be added while the computations are still underway. Consequently, the statistics reported by the methods are accurate at the time they return the results.
Unfortunately, this implementation is prone to deadlock because the recursive calls within the synchronized regions of these methods acquire the intrinsic locks in opposite numerical orders. That is, calculateAverageBandwidth() requests locks from index 0 to requests.size() - 1 whereas calculateAverageResponseTime() requests them from index requests.size() - 1 to 0. Because of recursion, no previously acquired locks are released by either method. A deadlock occurs when two threads call these methods out of order in that, one thread calls calculateAverageBandwidth() while the other calls calculateAverageResponseTime() before either method has finished executing.
For example, if there are 20 requests in the vector, and one thread calls getAverageBandwidth(), it acquires the intrinsic lock of WebRequest 0, the first element in the vector. Meanwhile, if a second thread calls getAverageResponseTime(), it acquires the intrinsic lock for WebRequest 19, the last element in the vector. Consequently, deadlock results because neither thread can acquire all of the locks and proceed with the calculations.
Compliant Solution
In this compliant solution, the two calculation methods acquire and release locks in the same order, beginning with the first request in the vector.
public class WebRequestAnalyzer {
private final Vector<WebRequest> requests = new Vector<WebRequest>();
public boolean addWebRequest(WebRequest request) {
// No need to lock on the last element because locks are acquired in increasing order
return requests.add(new WebRequest(request.getBandwidth(), request.getResponseTime()));
}
public double getAverageBandwidth() {
return calculateAverageBandwidth(0, 0);
}
public double getAverageResponseTime() {
return calculateAverageResponseTime(0, 0);
}
private double calculateAverageBandwidth(int i, long bandwidth) {
if (i > requests.size()) {
return bandwidth / requests.size();
}
synchronized (requests.elementAt(i)) { // Acquires locks in increasing order
bandwidth += requests.get(i).getBandwidth();
return calculateAverageBandwidth(++i, bandwidth);
}
}
private double calculateAverageResponseTime(int i, long responseTime) {
if (i > requests.size()) {
return responseTime / requests.size();
}
synchronized (requests.elementAt(i)) {
responseTime += requests.get(i).getResponseTime();
return calculateAverageResponseTime(++i, responseTime); // Acquires locks in increasing order
}
}
}
Consequently, while one thread is calculating the average bandwidth or response time, another thread cannot interfere or induce a deadlock. This is because the other thread would first have to synchronize on the first WebRequest, which is impossible until the first calculation is complete.
Risk Assessment
Acquiring and releasing locks in the wrong order may result in deadlocks.
Rule |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
|---|---|---|---|---|---|
CON12- J |
low |
likely |
high |
P3 |
L3 |
Automated Detection
TODO
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
[[JLS 05]] Chapter 17, Threads and Locks
[[Halloway 00]]
[[MITRE 09]] CWE ID 412 "Unrestricted Lock on Critical Resource"
CON11-J. Do not assume that declaring an object volatile guarantees visibility of its members 11. Concurrency (CON) CON13-J. Ensure that threads are stopped cleanly