Page History

Accessing the stack or thread-local variables of a thread from another thread can cause invalid memory accesses because the execution of threads can be interwoven within the constraints of the synchronization model. As a result, the referenced stack frame or thread-local variable may not be valid when the other thread tries to access it. Regular shared variables should be protected by thread synchronization mechanisms. However, local variables should not be shared in the same fashion because the referenced stack frame's thread would have to stop executing, or some other way must be found to ensure that the referenced stack frame is still valid. See CON32-C. Prevent data races when data must be accessed by multiple threads and guarantee that no adjacent data is also accessedaccessing bit-fields from multiple threads for information on how to securely share nonautomatic and non-thread-local variables. See DCL30-C. Declare objects with appropriate storage durations for information on how to declare objects with appropriate storage durations when data is not being shared between threads. Note that this is a specific instance of CON34-C. Declare objects shared between threads with appropriate storage durations for POSIX threads.

...

Code Block

bgColor	#FFCCCC
lang	c

void *childThread(void *val) {
  /*
   * Depending on the order of thread execution, the object
   * referred to by val may be out of its lifetime, resulting
   * in a potentially incorrect result being printed out.
   */
  int *res = (int *)val;
  printf("Result: %d\n", *res);
  return NULL;
}

void createThread(pthread_t *tid) {
  /* Store 1 in val on the stack. */
  int val = 1;
  int result;
  if ((result = pthread_create(tid, NULL, childThread, &val)) != 0) {
    /* Handle Errorerror */
  }
}

int main(void) {
  pthread_t tid;
  int result;
  createThread(&tid);
  if ((result = pthread_join(tid, NULL)) != 0) {
    /* Handle Errorerror */
  }
  return 0;
}

Implementation Details

...

This noncompliant code example is incorrect because createThread() can finish running before childThread(), so childThread() may not access a valid object.:

Code Block

bgColor	#FFCCCC
lang	c

__thread int val;

void *childThread(void *val) {
  int *res = (int *)val;

  printf("Result: %d\n", *res);
  return NULL;
}

void *createThread(void *childTid) {
  pthread_t *tid = (pthread_t *)childTid;
  int result;
  val = 1;
  if ((result = pthread_create(tid, NULL, childThread, &val)) != 0) {
    /* Handle Errorerror */
  }
  return NULL;
}

void *empty(void *arg) {
  /* Function that does nothing. */
  val = 0;
  return NULL;
}

int main(void) {
  pthread_t parentTid, childTid, emptyTid;
  int result;

  /*
   * createThread() may complete before childThread(), and
   * the thread-local variable, val, belonging to createThread(),
   * may no longer be valid when childThread() runs.
   */
  if ((result = pthread_create(&parentTid, NULL, createThread, &childTid)) != 0) {
    /* Handle Errorerror */
  }
  if ((result = pthread_join(parentTid, NULL)) != 0) {
    /* Handle Errorerror */
  }
  if ((result = pthread_create(&emptyTid, NULL, empty, NULL)) != 0) {
    /* Handle Errorerror */
  }
  if ((result = pthread_join(emptyTid, NULL)) != 0) {
    /* Handle Errorerror */
  }
  if ((result = pthread_join(childTid, NULL)) != 0) {
    /* Handle Errorerror */
  }
  return 0;
}

Implementation Details

...

Code Block

bgColor	#ccccff
lang	c

void *childThread(void *val) {
  /* Correctly prints 1 */
  int *res = (int *)val;
  printf("Result: %d\n", *res);
  free(res);
  return NULL;
}

void createThread(pthread *tid) {
  int result;
  /* Copy data into dynamic memory. */
  int *val = malloc(sizeof(int));

  if (!val) {
    /* Handle Errorerror */
  }
  *val = 1;
  if ((result = pthread_create(&id, NULL, childThread, val)) != 0) {
    /* Handle Errorerror */
  }
}

int main(void) {
  pthread_t tid;
  int result;
  createThread(&tid);
  if ((result = pthread_join(tid, NULL)) != 0) {
    /* Handle Errorerror */
  }
  return 0;
}

Compliant Solution (Static Storage)

...

Code Block

bgColor	#ccccff
lang	c

/* Declare val as a global static variable. */
int val;

void *childThread(void *val) {
  /* Correctly prints 1 */
  int *res = (int *)val;
  printf("Result: %d\n", *res);
  return NULL;
}

void createThread(pthread_t *tid) {
  val = 1;
  int result;
  if ((result = pthread_create(tid, NULL, childThread, &val)) != 0) {
    /* Handle Errorerror */
  }
}

int main(void) {
  pthread_t tid;
  createThread(&tid);
  int result;
  if ((result = pthread_join(tid, NULL)) != 0) {
    /* Handle Errorerror */
  }
  return 0;
}

Compliant Solution (Automatic Storage)

Another solution is to ensure that local variables shared between threads are declared in the same or previous stack frame as a call to a thread synchronization mechanism, such as pthread_join(). For example, in the following this compliant solution, val is declared in main(), where pthread_join() is called. Because the parent thread will wait until the child thread completes before continuing its execution, the child thread is guaranteed to access an object that is still within its lifetime.

Code Block

bgColor	#ccccff
lang	c

void *childThread(void *val) {
  /* Correctly prints 1 */
  int *res = (int *)val;
  printf("Result: %d\n", *res);
  return NULL;
}

void createThread(pthread_t *tid, int *val) {
  int result = pthread_create(tid, NULL, childThread, val);
  if (result != 0) {
    /* Handle Errorerror */
  }
}

int main(void) {
  /* Declare val in the same function as pthread_join. */
  int val = 1;
  int result;
  pthread_t tid;
  createThread(&tid, &val);
  if ((result = pthread_join(tid, NULL)) != 0) {
    /* Handle Errorerror */
  }
  return 0;
}

Compliant Solution (Thread-Local Storage)

...

Code Block

bgColor	#ccccff
lang	c

/* Declare val as a thread-local value. */
__thread int val;

void *childThread(void *val) {
  /* Correctly prints 1 */
  int *res = (int *)val;
  printf("Result: %d\n", *res);
  return NULL;
}

void createThread(pthread_t *tid) {
  val = 1;
  int result = pthread_create(tid, NULL, childThread, &val);
  if (result != 0) {
    /* Handle Errorerror */
  }
}

int main(void) {
  pthread_t tid;
  int result;
  createThread(&tid);
  if ((result = pthread_join(tid, NULL)) != 0) {
    /* Handle Errorerror */
  }
  return 0;
}

Risk Assessment

Threads that reference the stack of other threads can potentially overwrite important information on the stack, such as function pointers and return addresses. However, it would be difficult for an attacker to exploit this code from this error alone. The compiler will not generate warnings if the programmer decides to give another thread access to one thread's local variables, so a programmer may not catch a potential error at compile time. The remediation cost for this error is high because analysis tools have difficulty diagnosing problems with concurrency and race conditions.

Recommendation	Severity	Likelihood

Remediation Cost

Detectable	Repairable	Priority	Level
POS50-C	Medium

medium

Probable

probable

No

high

No

P4

L3

...

Automated Detection

Tool

Version

Checker

Description

Helix QAC

Include Page

	Helix QAC_V
	Helix QAC_V

DF4926, DF4927, DF4928

Parasoft C/C++test

Include Page

	Parasoft_V
	Parasoft_V

CERT_C-POS50-a

Declare objects shared between POSIX threads with appropriate storage durations

Polyspace Bug Finder

Include Page

	Polyspace Bug Finder_V
	Polyspace Bug Finder_V

CERT C: Rule POS50-C

Checks for automatic or thread local variable escaping from a POSIX thread (rule fully covered)

Bibliography

[Bryant 2003]	Chapter 13, "Concurrent Programming"
[OpenMP]

...

Image Modified Image Modified Image Modified

Space shortcuts

Page tree

Versions Compared

Old Version 5

New Version Current

Key

Implementation Details

Implementation Details

Compliant Solution (Static Storage)

Compliant Solution (Automatic Storage)

Compliant Solution (Thread-Local Storage)

Risk Assessment

Automated Detection

Bibliography