CERT C: Rule CON41-C

Wrap functions that can fail spuriously in a loop

expand all in page

Description

Rule Definition

Wrap functions that can fail spuriously in a loop.¹

Polyspace Implementation

The rule checker checks for Function that can spuriously fail not wrapped in loop.

Examples

expand all

Function that can spuriously fail not wrapped in loop

Issue

Function that can spuriously fail not wrapped in loop occurs when the following atomic compare and exchange functions that can fail spuriously are called from outside a loop.

C atomic functions:
- atomic_compare_exchange_weak()
- atomic_compare_exchange_weak_explicit()
C++ atomic functions:
- std::atomic<T>::compare_exchange_weak(T* expected, T desired)
- std::atomic<T>::compare_exchange_weak_explicit(T* expected, T desired, std::memory_order succ, std::memory_order fail)
- std::atomic_compare_exchange_weak(std::atomic<T>* obj, T* expected, T desired)
- std::atomic_compare_exchange_weak_explicit(volatile std::atomic<T>* obj, T* expected, T desired, std::memory_order succ, std::memory_order fail)

The functions compare the memory contents of the object representations pointed to by obj and expected. The comparison can spuriously return false even if the memory contents are equal. This spurious failure makes the functions faster on some platforms.

Risk

An atomic compare and exchange function that spuriously fails can cause unexpected results and unexpected control flow.

Fix

Wrap atomic compare and exchange functions that can spuriously fail in a loop. The loop checks the failure condition after a possible spurious failure.

Example - atomic_compare_exchange_weak() Not Wrapped in Loop

#include <stdatomic.h>

extern void reset_count(void);
atomic_int count = ATOMIC_VAR_INIT(0);

void increment_count(void)
{
    int old_count = atomic_load(&count);
    int new_count;
    new_count = old_count + 1;
    if (!atomic_compare_exchange_weak(&count, &old_count, new_count)) //Noncompliant
        reset_count();

}

In this example, increment_count() uses atomic_compare_exchange_weak() to compare count and old_count. If the counts are equal, count is incremented to new_count. If they are not equal, the count is reset. When atomic_compare_exchange_weak() fails spuriously, the count is reset unnecessarily.

Correction — Wrap atomic_compare_exchange_weak() in a while Loop

One possible correction is to wrap the call to atomic_compare_exchange_weak() in a while loop. The loop checks the failure condition after a possible spurious failure.

#include <stdatomic.h>

extern void reset_count(void);
atomic_int count = ATOMIC_VAR_INIT(0);

void increment_count(void)
{
    int old_count = atomic_load(&count);
    int new_count;
    new_count = old_count + 1;

    do {
        reset_count();

    } while (!atomic_compare_exchange_weak(&count, &old_count, new_count));

}

Check Information

Group: Rule 14. Concurrency (CON)

Version History

Introduced in R2019a

¹ This software has been created by MathWorks incorporating portions of: the “SEI CERT-C Website,” © 2017 Carnegie Mellon University, the SEI CERT-C++ Web site © 2017 Carnegie Mellon University, ”SEI CERT C Coding Standard – Rules for Developing safe, Reliable and Secure systems – 2016 Edition,” © 2016 Carnegie Mellon University, and “SEI CERT C++ Coding Standard – Rules for Developing safe, Reliable and Secure systems in C++ – 2016 Edition” © 2016 Carnegie Mellon University, with special permission from its Software Engineering Institute.

ANY MATERIAL OF CARNEGIE MELLON UNIVERSITY AND/OR ITS SOFTWARE ENGINEERING INSTITUTE CONTAINED HEREIN IS FURNISHED ON AN "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT.

This software and associated documentation has not been reviewed nor is it endorsed by Carnegie Mellon University or its Software Engineering Institute.