SEI CERT C Coding Standard

Space shortcuts

Page tree

Versions Compared

Old Version 2

changes.mady.by.user David Svoboda

Saved on

compared with

New Version Current

changes.mady.by.user Francesco Mariani

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

A consistent locking policy guarantees that multiple threads cannot simultaneously access or modify shared data. Atomic variables eliminate the need for locks by guaranteeing thread - safety when certain operations are performed on them. The thread-safe operations on atomic variables are defined specifically in C11, sections specified in the C Standard, subclauses 7.17.7 and 7.17.8 [ISO/IEC 9899:2024]. While they may atomic operations can be combined, combined operations do not provide the thread - safety provided by individual atomic operations.

Every time an atomic variable appears on the left hand side of an assignment operator, including a compound assignment operator such as {{*=}}, an atomic write is performed on the variable. Usage The use of the {{increment (++}} or {{) or decrement (--}} ) operators on an atomic variable constitute constitutes an atomic read-and-write operation and are thus is consequently thread-safe. Any reference of an atomic variable anywhere else in an expression indicates a distinct atomic read on the variable.

If the same atomic variable appears twice in an expression, then two atomic reads, or an atomic read and an atomic write, are required. Such a pair of atomic operations is not thread-safe and is therefore not permitted, as another thread can modify the atomic variable between the two operations. Consequently, an atomic variable must not be referenced twice in the same expression.

Noncompliant Code Example (atomic_bool)

This noncompliant code example declares a shared atomic_bool flag variable and provides a toggle_flag() method that negates the current value of flag:

...

Code Block
bgColor#FFcccc
langc

 

...

#include <stdatomic.h>

...


#include <stdbool.h>

...

 

...


  
static atomic_bool flag

...

 

...

 = ATOMIC_VAR_INIT(false);
  
void init_flag(void) {

...


  atomic_init(&flag, false);

...

}
 

...


}
  
void toggle_flag(void) {

...


  bool temp_flag = atomic_load(&flag);

...


  temp_flag = !temp_flag;

...


  atomic_store(&flag, temp_flag);

...

}
   

...


}
    
bool get_flag(void) {

...


  return atomic_load(&flag);

...


}

...

Execution of this code may result in

...

unexpected behavior because the value of flag is read, negated, and written back. This occurs

...

even though the

...

read and write are both atomic.

Consider, for example, two threads that call toggle_flag(). The expected effect of toggling flag twice is that it is restored to its original value. However, the scenario in the following

...

table leaves flag in the incorrect state.

toggle_flag() without Compare-and-Exchange
:

Time

flag

=

Thread

Action

1

true

t1

Reads the current value of flag,

 

 which is true, into a cache

2

true

t2

Reads the current value of flag,

(still) 

which is still true, into a different cache

3

true

t1

Toggles the temporary variable in the cache to false

4

true

t2

Toggles the temporary variable in the different cache to false

5

false

t1

Writes the cache variable's value to flag

6

false

t2

Writes the different cache variable's value to flag

As a result, the effect of the call by t2 is not reflected in flag; the program behaves as if toggle_flag() was was called only once, not twice.

Compliant Solution (atomic_compare_exchange_weak())

This compliant solution uses a compare-and-exchange to guarantee that the correct value is stored in flag. All updates are visible to other threads. The call to atomic_compare_exchange_weak() is in a loop in conformance with CON41-C.

 

Wrap functions that can fail spuriously in a loop.

Code Block
bgColor#ccccFF
langc
#include <stdatomic.h>

#include <stdbool.h>
 
static 

 
static atomic_bool flag
;
 
void 
 = ATOMIC_VAR_INIT(false);
 
void init_flag(void) {
  

  atomic_init(&flag, false);

}

 
void toggle_flag(void) {
  

  bool old_flag = atomic_load(&flag);
  

  bool new_flag;
  

  do
{    
 {
    new_flag = !old_flag;
  

  } while (!atomic_compare_exchange_weak(&flag, &old_flag, new_flag));
}
   
bool 

}
   
bool get_flag(void) {
  

  return atomic_load(&flag);

}

An alternative solution is to use the atomic_flag data type for managing Boolean values atomically. However

the 

, atomic_flag does not support a toggle operation.

Compliant Solution (Compound Assignment)

This compliant solution uses the ^=^  assignment   assignment operation to toggle flag. This operation is guaranteed to be atomic, according to C11to the C Standard, section 6.5.1617.25, paragraph 3 [ISO/IEC 9899:2024]. This operation performs a bitwise-exclusive-or between its arguments, but for boolean Boolean arguments, this is equivalent to negation.

 
Code Block
bgColor#ccccFF
langc
#include <stdatomic.h>

#include <stdbool.h>
 
static 

  
static atomic_bool flag = ATOMIC_VAR_INIT(false
;
 
void 
);
  
void toggle_flag(void) {
  

  flag ^= 1;
}
   
bool 

}
    
bool get_flag(void) {
  

  return flag;

}
Another

An alternative solution is to use

mutexes

a mutex to protect the atomic operation, but this solution loses the performance benefits of atomic variables.

Noncompliant Code Example

This noncompliant code example takes an atomic global variable n and computes n + (n - 1) + (n - 2) + ... + 1, using the formula n * (n + 1) / 2:

Code Block
bgColor#FFcccc
langc
#include <stdatomic.h>

atomic_int n = ATOMIC_VAR_INIT(0);
  
int compute_sum(void) {
  return n * (n + 1) / 2;
}

The value of n may change between the two atomic reads of n in the expression, yielding an incorrect result.

 

Compliant Solution

This compliant solution passes the atomic variable as a function argument, forcing the variable to be copied and guaranteeing a correct result. Note that the function's formal parameter need not be atomic, and the atomic variable can still be passed as an actual argument.

Code Block
bgColor#ccccff
langc
#include <stdatomic.h>
 
int compute_sum(int n) {
  return n * (n + 1) / 2;
}

Risk Assessment

When operations on atomic variables are assumed to be atomic, but are not atomic, surprising data races can occur, leading to corrupted data and invalid control flow.

Rule

Severity

Likelihood

Detectable

Repairable

Priority

Level

CON40-C

Medium

Probable

Yes

No

P8

L2

Automated Detection

Tool

Version

Checker

Description

Astrée
Include Page
Astrée_V
Astrée_V
multiple-atomic-accessesPartially checked
Axivion Bauhaus Suite

Include Page
Axivion Bauhaus Suite_V
Axivion Bauhaus Suite_V

CertC-CON40
CodeSonar
Include Page
CodeSonar_V
CodeSonar_V

CONCURRENCY.MAA

Multiple Accesses of Atomic
Coverity
Include Page
Coverity_V
Coverity_V

EVALUATION_ORDER (partial)

MISRA 2012 Rule 13.2

VOLATILE_ATOICITY (possible)

Implemented
Cppcheck Premium

Include Page
Cppcheck Premium_V
Cppcheck Premium_V

premium-cert-con40-c
Helix QAC

Include Page
Helix QAC_V
Helix QAC_V

C1114, C1115, C1116

C++3171, C++4150


Klocwork
Include Page
Klocwork_V
Klocwork_V

CERT.CONC.ATOMIC_TWICE_EXPR


Parasoft C/C++test

Include Page
Parasoft_V
Parasoft_V

CERT_C-CON40-a

Do not refer to an atomic variable twice in an expression

Polyspace Bug Finder

Include Page
Polyspace Bug Finder_V
Polyspace Bug Finder_V

CERT C: Rule CON40-C

Checks for:

  • Atomic variable accessed twice in an expression
  • Atomic load and store sequence not atomic

Rule fully covered.

RuleChecker

Include Page
RuleChecker_V
RuleChecker_V

multiple-atomic-accessesPartially checked
Security Reviewer - Static Reviewer

6.02

C122
C123		Fully Implemented

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Key here (explains table format and definitions)

Taxonomy

Taxonomy item

Relationship

CWE 2.11CWE-366, Race Condition within a Thread2017-07-07: CERT: Rule subset of CWE

CERT-CWE Mapping Notes

Key here for mapping notes

CWE-366 and CON40-C

CON40-C = Subset( CON43-C) Intersection( CON32-C, CON40-C) = Ø

CWE-366 = Union( CON40-C, list) where list =


  • C data races that do not involve an atomic variable used twice within an expression



Bibliography

[ISO/IEC 9899:2024]

6.5.17.3, "Compound Assignment"
7.17, "Atomics"


Image Added Image Added Image Added