Threads that invoke wait()
expect to wake up and resume execution when their condition predicate becomes true. To be compliant with rule THI03-J. Always invoke wait() and await() methods inside a loop, waiting threads must test their condition predicates upon receiving notifications and must resume waiting if the predicates are false.
The notify()
and notifyAll()
methods of package java.lang.Object
are used to wake up waiting thread(s). These methods must be invoked from a thread that holds the same object lock as the waiting thread(s); these methods throw an IllegalMonitorStateException
when invoked from any other thread. The notifyAll()
method wakes up all threads associated with an object lock and allows threads whose condition predicate is true to resume execution. Furthermore, if all the threads whose condition predicate evaluates to true previously held a specific lock before going into the wait state, only one of them will reacquire the lock upon being notified. Presumably, the other threads will resume waiting. The notify()
method wakes up only one thread, and any guarantee regarding which specific thread is notified. The chosen thread is permitted to resume waiting if its condition predicate is unsatisfied; this often defeats the purpose of the notification.
Consequently, the invoking the notify()
method is permitted only when all of the following conditions are met:
- All waiting threads have identical condition predicates.
- All threads perform the same set of operations after waking up. That is, any one thread can be selected to wake up and resume for a single invocation of
notify()
. - Only one thread is required to wake upon the notification.
These conditions are satisfied by threads that are identical and provide a stateless service or utility.
The java.util.concurrent
utilities (Condition
interface) provide the signal()
and signalAll()
methods to awaken threads that are blocked on an await()
call. Condition
objects are required when using Lock
objects. A Lock
object allows the use of wait()
and notify()
methods. However, code that synchronizes using a Lock
object uses one or more Condition
objects associated with the Lock
object rather than using its own intrinsic lock. These objects interact directly with the locking policy enforced by the Lock
object. Consequently, the Condition.await()
, Condition.signal()
, and Condition.signalAll()
methods are used in place of the Object.wait()
, Object.notify()
, and Object.notifyAll()
methods.
Use of the signal()
method is insecure when multiple threads await the same Condition
object unless the following conditions are met:
- The
Condition
object is identical for each waiting thread. - All threads must perform the same set of operations after waking up. This means that any one thread can be selected to wake up and resume for a single invocation of
signal()
. - Only one thread is required to wake upon receiving the signal.
Insecure use of the signal()
method is forbidden.
Use of the signal()
method is also permitted when both of the following conditions are met:
- Each thread uses a unique
Condition
object. - Each
Condition
object is associated with a commonLock
object.
The signal()
method has better performance than signalAll()
when used securely.
Noncompliant Code Example (notify()
)
This noncompliant code example shows a complex multistep process being undertaken by several threads. Each thread executes the step identified by the time field. Each thread waits for the time
field to indicate that it is time to perform the corresponding thread's step. After performing the step, each thread increments time
and then notifies the thread that is responsible for the next step.
public final class ProcessStep implements Runnable { private static final Object lock = new Object(); private static int time = 0; private final int step; // Do operations when field time reaches this value public ProcessStep(int step) { this.step = step; } @Override public void run() { try { synchronized (lock) { while (time != step) { lock.wait(); } // Perform operations time++; lock.notify(); } } catch (InterruptedException ie) { Thread.currentThread().interrupt(); // Reset interrupted status } } public static void main(String[] args) { for (int i = 4; i >= 0; i--) { new Thread(new ProcessStep(i)).start(); } } }
This noncompliant code example violates the liveness property. Each thread has a different condition predicate because each requires step
to have a different value before proceeding. The Object.notify()
method wakes up only one thread at a time. Unless it happens to wake up the thread that is required to perform the next step, the program will deadlock.
Compliant Solution (notifyAll()
)
In this compliant solution, each thread completes its step and then calls notifyAll()
to notify the waiting threads. The thread that is ready can then perform its task, while all the threads whose condition predicates are false (loop condition expression is true) promptly resume waiting.
Only the run()
method from the noncompliant code example is modified, as follows:
public final class ProcessStep implements Runnable { private static final Object lock = new Object(); private static int time = 0; private final int step; // Do operations when field time reaches this value public ProcessStep(int step) { this.step = step; } @Override public void run() { try { synchronized (lock) { while (time != step) { lock.wait(); } // Perform operations time++; lock.notifyAll(); // Use notifyAll() instead of notify() } } catch (InterruptedException ie) { Thread.currentThread().interrupt(); // Reset interrupted status } } }
Noncompliant Code Example (Condition
Interface)
This noncompliant code example is similar to the noncompliant code example for notify()
but uses the Condition
interface for waiting and notification.
public class ProcessStep implements Runnable { private static final Lock lock = new ReentrantLock(); private static final Condition condition = lock.newCondition(); private static int time = 0; private final int step; // Do operations when field time reaches this value public ProcessStep(int step) { this.step = step; } @Override public void run() { lock.lock(); try { while (time != step) { condition.await(); } // Perform operations time++; condition.signal(); } catch (InterruptedException ie) { Thread.currentThread().interrupt(); // Reset interrupted status } finally { lock.unlock(); } } public static void main(String[] args) { for (int i = 4; i >= 0; i--) { new Thread(new ProcessStep(i)).start(); } } }
As with Object.notify()
, the signal()
method may awaken an arbitrary thread.
Compliant Solution (signalAll()
)
This compliant solution uses the signalAll()
method to notify all waiting threads. Before await()
returns, the current thread reacquires the lock associated with this condition. When the thread returns, it is guaranteed to hold this lock [[API 2006]] The thread that is ready can perform its task, while all the threads whose condition predicates are false resume waiting.
Only the run()
method from the noncompliant code example is modified, as follows:
public class ProcessStep implements Runnable { private static final Lock lock = new ReentrantLock(); private static final Condition condition = lock.newCondition(); private static int time = 0; private final int step; // Do operations when field time reaches this value public ProcessStep(int step) { this.step = step; } @Override public void run() { lock.lock(); try { while (time != step) { condition.await(); } // Perform operations time++; condition.signalAll(); } catch (InterruptedException ie) { Thread.currentThread().interrupt(); // Reset interrupted status } finally { lock.unlock(); } } }
Compliant Solution (Unique Condition Per Thread)
This compliant solution assigns each thread its own condition. All the Condition
objects are accessible to all the threads.
// Declare class as final because its constructor throws an exception public final class ProcessStep implements Runnable { private static final Lock lock = new ReentrantLock(); private static int time = 0; private final int step; // Do operations when field time reaches this value private static final int MAX_STEPS = 5; private static final Condition[] conditions = new Condition[MAX_STEPS]; public ProcessStep(int step) { if (step <= MAX_STEPS) { this.step = step; conditions[step] = lock.newCondition(); } else { throw new IllegalArgumentException("Too many threads"); } } @Override public void run() { lock.lock(); try { while (time != step) { conditions[step].await(); } // Perform operations time++; if (step + 1 < conditions.length) { conditions[step + 1].signal(); } } catch (InterruptedException ie) { Thread.currentThread().interrupt(); // Reset interrupted status } finally { lock.unlock(); } } public static void main(String[] args) { for (int i = MAX_STEPS - 1; i >= 0; i--) { ProcessStep ps = new ProcessStep(i); new Thread(ps).start(); } } }
Even though the signal()
method is used, only the thread whose condition predicate corresponds to the unique Condition
variable will awaken.
This compliant solution is safe only if untrusted code cannot create a thread with an instance of this class.
Risk Assessment
Notifying a single thread instead of all waiting threads can pose a threat to the liveness property of the system.
Rule |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
---|---|---|---|---|---|
THI04-J |
low |
unlikely |
medium |
P2 |
L3 |
Automated Detection
TODO
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Bibliography
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="3a18e508-a95f-4ae4-8283-f9693fc35ea1"><ac:plain-text-body><![CDATA[ |
[[API 2006 |
AA. Bibliography#API 06]] |
|
]]></ac:plain-text-body></ac:structured-macro> |
|
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="1c0b9062-3453-4a20-836e-0b54bc602483"><ac:plain-text-body><![CDATA[ |
[[JLS 2005 |
AA. Bibliography#JLS 05]] |
[Chapter 17, Threads and Locks |
http://java.sun.com/docs/books/jls/third_edition/html/memory.html] |
]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="9e96771a-b60e-46df-966f-b1096ecee1c9"><ac:plain-text-body><![CDATA[ |
[[Goetz 2006 |
AA. Bibliography#Goetz 06]] |
Section 14.2.4, Notification |
]]></ac:plain-text-body></ac:structured-macro> |
|
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="0e154d07-e994-4fe6-812d-80335d3f999a"><ac:plain-text-body><![CDATA[ |
[[Bloch 2001 |
AA. Bibliography#Bloch 01]] |
Item 50: Never invoke wait outside a loop |
]]></ac:plain-text-body></ac:structured-macro> |