A consistent locking policy guarantees that multiple threads cannot simultaneously access or modify shared data. Atomic variables eliminate the need for locks by guaranteeing thread-safety when certain operations are performed on them. The thread-safe operations on atomic variables are defined specifically in the C Standard, subclauses 7.17.7 and 7.17.8. While atomic operations can be combined, combined operations do not provide the thread-safety provided by individual atomic operations.
Every time an atomic variable appears on the left hand side of an assignment operator, including a compound assignment operator such as *=, an atomic write is performed on the variable. The use of the increment (++) or decrement (--) operators on an atomic variable constitute an atomic read-and-write operation and are consequently thread-safe. Any reference of an atomic variable anywhere else in an expression indicates a distinct atomic read on the variable.
If the same atomic variable appears twice in an expression, then two atomic reads, or an atomic read and an atomic write, are required. Such a pair of atomic operations is not thread-safe, as an outside thread might modify the atomic variable between the two operations. Consequently, an atomic variable must not be referenced twice in the same expression.
Noncompliant Code Example (atomic_bool)
This noncompliant code example declares a shared atomic_bool flag variable and provides a toggle_flag() method that negates the current value of flag:
#include <stdatomic.h>#include <stdbool.h> static atomic_bool flag;void init_flag(void) { atomic_init(&flag, false);}void toggle_flag(void) { bool temp_flag = atomic_load(&flag); temp_flag = !temp_flag; atomic_store(&flag, temp_flag);} bool get_flag(void) { return atomic_load(&flag);} |
Execution of this code may result in a data race because the value of flag is read, negated, and written back. This occurs even though the read and write are both atomic.
Consider, for example, two threads that call toggle_flag(). The expected effect of toggling flag twice is that it is restored to its original value. However, the following scenario leaves flag in the incorrect state:
Time |
| Thread | Action |
|---|---|---|---|
1 |
| t1 | Reads the current value of |
2 |
| t2 | Reads the current value of |
3 |
| t1 | Toggles the temporary variable in the cache to |
4 |
| t2 | Toggles the temporary variable in the different cache to |
5 |
| t1 | Writes the cache variable's value to |
6 |
| t2 | Writes the different cache variable's value to |
As a result, the effect of the call by t2 is not reflected in flag; the program behaves as if toggle_flag() was called only once, not twice.
Compliant Solution (atomic_compare_exchange_weak())
This compliant solution uses a compare and exchange to guarantee that the correct value is stored in flag. All updates are visible to other threads. The call to atomic_compare_exchange_weak() is in a loop in conformance to .
#include <stdatomic.h>#include <stdbool.h> static atomic_bool flag;void init_flag(void) { atomic_init(&flag, false);}void toggle_flag(void) { bool old_flag = atomic_load(&flag); bool new_flag; do { new_flag = !old_flag; } while (!atomic_compare_exchange_weak(&flag, &old_flag, new_flag));} bool get_flag(void) { return atomic_load(&flag);} |
An alternative solution is to use the atomic_flag data type for managing Boolean values atomically. However the atomic_flag does not support a toggle operation.
Compliant Solution (Compound Assignment)
This compliant solution uses the =^ assignment operation to toggle flag. This operation is guaranteed to be atomic, according to the C Standard, subclause 6.5.16.2, paragraph 3. This operation performs a bitwise-exclusive-or between its arguments, but for boolean arguments this is equivalent to negation.
#include <stdatomic.h>#include <stdbool.h> static atomic_bool flag = false;void toggle_flag(void) { flag ^= 1;} bool get_flag(void) { return flag;} |
Noncompliant Code Example
This noncompliant code example takes an atomic variable n and computes n + (n-1) + (n-2) + ... + 1, using the formula n * (n+1) / 2.
#include <stdatomic.h>
void compute_sum(atomic_int n) {
return n * (n + 1) / 2;
}
Unfortunately, the value of n may change between the two atomic reads of n in the expression, yielding an incorrect result.
Compliant Solution
This compliant solution copies the atomic value to a local variable, guaranteeing a correct result.
#include <stdatomic.h>
void compute_sum(atomic_int n) {
int my_n = n;
return my_n * (my_n + 1) / 2;
}
Risk Assessment
When operations on atomic variables are assumed to be atomic, but are not atomic, surprising data races can occur, leading to corrupted data and invalid control flow.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
CON42-C | Medium | Probable | Medium | P8 | L2 |
Related Guidelines
CWE-366, Race condition within a thread |
Bibliography
Subclause 7.17, "Atomics" |
