Any thread that invokes wait() expects to wake up and resume execution when some condition predicate becomes true. As recommended by CON18-J. Always invoke wait() and await() methods inside a loop, waiting threads should test their condition predicates upon receiving notifications and resume waiting if they are false.
The methods notify() and notifyAll() of package java.lang.Object are used to waken waiting thread(s). These methods must be invoked from code that holds the same object lock as the waiting thread(s). The notifyAll() method wakes up all threads and allows ones whose condition predicate is true to resume execution. Furthermore, if all the threads whose condition predicate is now true held a specific lock before going into wait state, only one of them will reacquire the lock upon being notified, and the others may, presumably, resume waiting. The notify() method wakes up only one thread, and makes no guarantees as to which thread is notified. If the thread's condition predicate is not satisfied, the chosen thread may not awaken, defeating the purpose of the notify() call.
The notify() method may only be invoked if:
notify().wait() on the object and intercept a notify() call.The java.util.concurrent utilities (interface Condition) provide the signal() and signalAll() methods to awaken waiting threads that are blocked on an await() call. Like the notify() method, the signal() method wakes up any one of the threads that is waiting on the condition and consequently, may be insecure. It is always safer to use signalAll albeit a small performance penalty. Similarly, any thread that is blocked on a wait() method invocation on a Java object being used as a condition queue, should be notified using notifyAll().
notify())This noncompliant code example shows a complex multi-step process being undertaken by several threads. Each thread executes one step of the process; the step being currently performed is enumerated by the step field. Each thread waits for the step field to indicate that it is time to perform the corresponding thread's step. After performing the step, each thread increments step to transfer control to the next thread, notifies it, and exits.
public class ProcessStep implements Runnable {
private static final Object lock = new Object();
private static int time = 0;
private final int step; // Do operations when the step reaches this value
public ProcessStep(int step) {
this.step = step;
}
public void run() {
try {
synchronized (lock) {
while (time != step) {
lock.wait();
}
// ... Do operations
time++;
lock.notify();
}
} catch (InterruptedException ie) {
Thread.currentThread().interrupt(); // Reset interrupted status
}
}
public static void main(String[] args) {
for (int i = 4; i >= 0; i--) {
ProcessStep ms = new ProcessStep(i);
new Thread(ms).start();
}
}
}
|
This noncompliant code example violates the liveness property. Each thread has a different condition predicate, as each requires step to have a different value before proceeding. The Object.notify() method wakes up only one thread at a time. unless it happens to wake up the thread that is to perform the next step, the program deadlocks.
In this compliant solution, all threads that have performed their own step use notifyAll() to notify other waiting threads. Consequently, the respective threads that are ready can perform the task, while all other threads whose condition predicate is unsatisfied promptly go back to sleep.
// ...
public void run() {
try {
synchronized (lock) {
while (time != step) {
lock.wait();
}
// ... do stuff
time++;
lock.notifyAll();
}
} catch (InterruptedException ie) {
Thread.currentThread().interrupt(); // Reset interrupted status
}
}
|
Condition interface)This noncompliant code example derives from the previous noncompliant code example but uses the Condition interface. Field condition is used to let threads wait on different condition predicates.
public class ProcessStep implements Runnable {
private static final Lock lock = new ReentrantLock();
private static final Condition condition = lock.newCondition();
private static int time = 0;
private final int step; // Do operations when the step reaches this value
public ProcessStep(int step) {
this.step = step;
}
public void run() {
lock.lock();
try {
while (time != step) {
condition.await();
}
// ... Do operations
time++;
condition.signal();
} catch (InterruptedException ie) {
Thread.currentThread().interrupt(); // Reset interrupted status
} finally {
lock.unlock();
}
}
public static void main(String[] args) {
for (int i = 4; i >= 0; i--) {
ProcessStep ms = new ProcessStep(i);
new Thread(ms).start();
}
}
}
|
Similar to Object.notify(), the Condition.signal() method may choose any one thread and awaken it.
signalAll())This compliant solution uses the signalAll() method to resume all the waiting threads whose condition predicate allows doing so.
public void run() {
lock.lock();
try {
while (time != step) {
condition.await();
}
// ... do stuff
time++;
condition.signalAll();
} catch (InterruptedException ie) {
Thread.currentThread().interrupt(); // Reset interrupted status
} finally {
lock.unlock();
}
}
|
This compliant solution assigns each thread its own Condition, and makes them accessible to all the threads.
// Declare class as final because its constructor throws an exception
public final class ProcessStep implements Runnable {
private static final Lock lock = new ReentrantLock();
private static int time = 0;
private final int step; // Do operations when the step reaches this value
private static final int MAX_STEPS = 5;
private static final Condition[] conditions = new Condition[MAX_STEPS];
public ProcessStep(int step) {
if (step <= MAX_STEPS) {
this.step = step;
conditions[step] = lock.newCondition();
} else {
throw new IllegalArgumentException("Too many threads");
}
}
public void run() {
lock.lock();
try {
while (time != step) {
conditions[step].await();
}
// ... Do operations
time++;
if (step + 1 < conditions.length) {
conditions[step + 1].signal();
}
} catch (InterruptedException ie) {
Thread.currentThread().interrupt(); // Reset interrupted status
} finally {
lock.unlock();
}
}
public static void main(String[] args) {
for (int i = MAX_STEPS - 1; i >= 0; i--) {
ProcessStep ms = new ProcessStep(i);
new Thread(ms).start();
}
}
}
|
Even though signal() is used, it is guaranteed that only one thread will awaken because each condition predicate corresponds to a unique Condition variable.
Invoking the notify() method instead of notifyAll() can be a threat to the liveness property of the system.
Rule |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
|---|---|---|---|---|---|
CON19- J |
low |
unlikely |
medium |
P2 |
L3 |
TODO
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
\[[JLS 05|AA. Java References#JLS 05]\] [Chapter 17, Threads and Locks|http://java.sun.com/docs/books/jls/third_edition/html/memory.html] \[[Goetz 06|AA. Java References#Goetz 06]\] Section 14.2.4, Notification \[[Bloch 01|AA. Java References#Bloch 01]\] Item 50: Never invoke wait outside a loop |
CON18-J. Always invoke wait() and await() methods inside a loop 11. Concurrency (CON) CON20-J. Do not perform operations that may block while holding a lock