Page History

Misuse of synchronization primitives is a common source of concurrency issues. Synchronizing on objects that may be reused can result in deadlock and non-deterministic behaviornondeterministic behavior. Consequently, programs must never synchronize on objects that may be reused.

Noncompliant Code Example (Boolean Lock Object)

This noncompliant code example synchronizes on a Boolean lock object.

private final Boolean initialized = Boolean.FALSE;

public void doSomething() {
  synchronized (initialized) { 
    // ...
  }
}

The Boolean type is unsuitable for locking purposes because it allows only two values: TRUE true and FALSEfalse. Boolean literals containing the same value share unique instances of the Boolean class Boolean in the Java Virtual Machine (JVM). In this example, initialized references refers to the instance corresponding to the value Boolean.FALSE. If any other code were to inadvertently synchronizes synchronize on a Boolean literal with the this value FALSE, the lock instance is would be reused and the system can could become unresponsiveness unresponsive or deadlockedcould deadlock.

Noncompliant Code Example (Boxed Primitive)

This noncompliant code example locks on a boxed Integer object.

private int lockcount = 0;
private final Integer Lock = lockcount; // Boxed primitive Lock is shared

public void doSomething() {
  synchronized (Lock) {
    count++;
    // ...
  }
}

Boxed types may use the same instance for a range of integer values and ; consequently, they suffer from the same reuse problem as Boolean constants. If The wrapper object are reused when the value of the primitive can be represented as a byte, the wrapper object is reused. Note that the use of the ; JVM implementations are also permitted to reuse wrapper objects for larger ranges of values. While use of the intrinsic lock associated with the boxed Integer wrapper object is insecure; instances of the Integer object constructed using the new operator (new Integer(value)) are unique and not reused. In general, holding a lock locks on any data type that contains a boxed value is are insecure.

Compliant Solution (Integer)

This compliant solution recommends locking locks on a non-boxed Integernonboxed Integer, using a variant of the private lock object idiom. The doSomething() method synchronizes using the intrinsic lock of the Integer instance, Lock.

private int lockcount = 0;
private final Integer Lock = new Integer(lockcount); 

public void doSomething() {
  synchronized (Lock) {
    count++;
    // ...
  }
}

When explicitly constructed, an Integer object has a unique reference and its own intrinsic lock that is distinct not shared with only from other Integer objects or , but also from boxed integers having that have the same value. While this is an acceptable solution, it can cause maintenance problems because developers can incorrectly assume that boxed integers are also appropriate lock objects. A more appropriate solution is to synchronize on a private final lock Object object as described in the following final compliant solution for this rule.

Noncompliant Code Example (Interned String Object)

This noncompliant code example locks on an interned String object.

private final String lock = new String("LOCK").intern();

public void doSomething() {
  synchronized (lock) {
    // ...
  }
}

Wiki MarkupAccording to the Java API \[[API 06|AA. Java References#API 06]\] class {{java.lang.String}} documentation documentation [API 2006]:

When the intern() method is invoked, if the pool already contains a string equal to this String object as determined by the equals(Object) method, then the string from the pool is returned. Otherwise, this String object is added to the pool and a reference to this String object is returned.

Consequently, an interned String object behaves like a global variable in the JVM. As demonstrated in this noncompliant code example, even if when every instance of an object maintains its own lock field lock, the field references fields all refer to a common String constant. Locking on String constants has the same reuse problem as locking on Boolean constants.

Additionally, hostile code from any other package can exploit this vulnerability, if the class is accessible. (For more information, see CON07See rule LCK00-J. Use private final lock objects to synchronize classes that may interact with untrusted code for more information.)

Noncompliant Code Example (String Literal)

This noncompliant code example locks on a final String literal.

// This bug was found in jetty-6.1.3 BoundedThreadPool
private final String lock = "LOCK";

// ...public void doSomething() {
  synchronized (lock) { 
    // ...
  }
// ...}

A String literal is a literals are constant and are automatically interned. Consequently, it this example suffers from the same pitfalls as the preceding noncompliant code example.

Compliant Solution (String Instance)

This compliant solution locks on a noninterned String instance that is not interned.

private final String lock = new String("LOCK");

public void doSomething() {
  synchronized (lock) {
    // ...
  }
}

A String instance differs from a String literal. The instance has a unique reference and its own intrinsic lock that is not shared by other string distinct from other String object instances or literals. A Nevertheless, a better approach is to synchronize on a private final lock object, as shown in the following compliant solution.

Compliant Solution (Private Final Lock Object)

This compliant solution synchronizes on a private final lock object. This is one of the few cases where in which a java.lang.Object instance is useful.

private final Object lock = new Object();

public void doSomething() {
  synchronized (lock) {
    // ...
  }
}

For more information on using an Object as a lock, see CON07rule LCK00-J. Use private final lock objects to synchronize classes that may interact with untrusted code.

Risk Assessment

A significant number of concurrency vulnerabilities arise from locking on the wrong kind of object. It is important to consider the properties of the lock object rather than indiscreetly simply scavenging for objects on which to synchronize on.

Automated Detection

The following table summarizes the examples flagged as violations by FindBugs:

Some static analysis tools can detect violations of this rule.

Related Vulnerabilities

Any vulnerabilities resulting from the violation of this rule are listed on the CERT website.

References

\[[API 06|AA. Java References#API 06]\] Class String, Collections
\[[Findbugs 08|AA. Java References#Findbugs 08]\]
\[[Pugh 08|AA. Java References#Pugh 08]\] "Synchronization"
\[[Miller 09|AA. Java References#Miller 09]\] Locking
\[[Tutorials 08|AA. Java References#Tutorials 08]\] [Wrapper Implementations|http://java.sun.com/docs/books/tutorial/collections/implementations/wrapper.html]

Bibliography

...

Image Added Image Added Image AddedCON02-J. Ensure that compound operations on shared variables are atomic      11. Concurrency (CON)      CON03-J. Do not use background threads during class initialization