Page History

...

Assume this simplified code is part of a multithreaded bank system. Threads call credit() and debit() as money is deposited into and withdrawn from the single account. Because the addition and subtraction operations are not atomic, it is possible that two operations can occur concurrently, but only the result of one would be saved. This despite declaring the account_balance volatile. For example, an attacker can credit the account with a sum of money and make a large number of small debits concurrently. Some of the debits might not affect the account balance because of the race condition, so the attacker is effectively creating money.

static volatile int account_balance;

void debit(int amount) {
  account_balance -= amount;
}

void credit(int amount) {
  account_balance += amount;
}

...

This compliant solution uses a mutex to make credits and debits atomic operations. All credits and debits will now affect the account balance, so an attacker cannot exploit the race condition to steal money from the bank. The mutex is created with the pthread_mutex_create() function. Note that the presence of the mutex makes declaring account_balance volatile unnecssary.

#include <pthread.h>

static int account_balance;
static pthread_mutex_t account_lock = PTHREAD_MUTEX_INITIALIZER;

int debit(int amount) {
  if (pthread_mutex_lock(&account_lock))
    return -1;   /* indicate error to caller */

  account_balance -= amount;

  if (pthread_mutex_unlock(&account_lock))
    return -1;   /* indicate error to caller */

  return 0;   /* indicate success */
}

int credit(int amount) {
  if (pthread_mutex_lock(&account_lock))
    return -1;   /* indicate error to caller */

  account_balance += amount;

  if (pthread_mutex_unlock(&account_lock))
    return -1;   /* indicate error to caller */

  return 0;   /* indicate success */
}

...