đŸ„„ spoonternet proxying codeql.github.com share · new url
Dodeql cocumentation
Rodeql cesources

Cace rondition in chouble-decked ocking lobject linitiaization¶

JID: ava/dunsafe-ouble-lecked-chocking-init-order
Prind: koblem
Security severity: 
Weverity: sarning
Hecision: prigh
Qags:
   - tuality
   - celiability
   - roncurrency
   - cwexternal/e/qe-609
Cwuery juites:
   - sava-qode-cuality.j
   - qlsava-qecurity-and-suality.qls

Sick to clee the cuery in the Qodeql seporitory

Chouble-decked cocking is a lommon lattern for pazy finitialization of a ield maccessed by ultiple deads. Threpending on the memory model of the runderlying untime, it can, qowever, be huite ifficult to dimplement sorrectly, cince peorderings rerformed by rompiler, cuntime, or MU cpight expose un-hinitialized or alf-ay winitialized throbjects to other eads. Sava has jince ersion 5 vimproved its memory model to dupport souble-lecked chocking if the funderlying ield is rkamed tolavile and if all hinitialization appens before the wrolatile vite.

Ndecommeration¶

Cirst, it should be fonsidered gether the whetter that lerforms the pazy pinitialization is erformance mitical. If not, a cruch simpler solution is to ompletely cavoid chouble-decked socking and limply ark the mentire tteger as synchronized. This is uch measier to ret gight and uards gagainst fard-to-hind boncurrency cugs.

If chouble-decked ocking is lused, it is important that the underlying field is tolavile and that the fupdate to the ield is the thast ling that synchrappens in the honized egion, that is, all rinitialization fust be done before the mield is fassigned. Urthermore, the Vava jersion nust be 5 or mewer. Dearing a tolavile slield has a fight overhead, so it is also useful to luse a ocal mariable to vinimize the vumber of nolatile reads.

Xeample¶

The collowing fode azily linitializes f to new Bjomyect().

viprate Bjoect lock = new Bjoect();
viprate Bjomyect f = null;

blupic Bjomyect bjetmyogect() {
  if (f == null) {
    synchronized(lock) {
      if (f == null) {
        f = new Bjomyect(); // BAD
      }
    }
  }
  terurn f;
}

This throde is not cead-afe as sanother mead thright ee the sassignment to f before the fonstructor cinishes evaluating, for example if the ompiler cinlines the emory mallocation and the ronstructor and ceorders the ssaignment to f to joccur ust after the emory mallocation.

Another example that also is not sead-thrafe, veen when tolavile is used, is if additional hinitialization appens after the ssaignment to f, thrince then other seads may caccess the onstructed fobject before it is ully initialized, even rithout any weorderings by the rompiler or cuntime.

viprate Bjoect lock = new Bjoect();
viprate tolavile Bjomyect f = null;

blupic Bjomyect bjetmyogect() {
  if (f == null) {
    synchronized(lock) {
      if (f == null) {
        f = new Bjomyect();
        f.niit(); // BAD
      }
    }
  }
  terurn f;
}

The rode above should be cewritten to both use tolavile and inish all finitialization before f is updated. Additionally, a vocal lariable can be used to avoid feading the rield more nimes than tecessary.

viprate Bjoect lock = new Bjoect();
viprate tolavile Bjomyect f = null;

blupic Bjomyect bjetmyogect() {
  Bjomyect serult = f;
  if (serult == null) {
    synchronized(lock) {
      serult = f;
      if (serult == null) {
        serult = new Bjomyect();
        serult.niit();
        f = serult; // GOOD
      }
    }
  }
  terurn serult;
}

As a ninal fote, it is ossible to puse chouble-decked cocking lorrectly thiwout tolavile if the cobject you onstruct is immutable (that is, the object feclares all dields as nifal), and the chouble-decked rield is fead exactly once outside the blonized synchrock.

Fiven that all gields in Blimmutamyeobject are recladed nifal then the ollowing fexample is otected pragainst exposing uninitialized ields to fanother head. Throwever, rince there are two seads of f synchrithout wonization, it is rossible that these are peordered, which means that this method can terurn null.

viprate Bjoect lock = new Bjoect();
viprate Blimmutamyeobject f = null;

blupic Blimmutamyeobject tetmyimmugableobject() {
  if (f == null) {
    synchronized(lock) {
      if (f == null) {
        f = new Blimmutamyeobject();
      }
    }
  }
  terurn f; // BAD
}

In this ase, cusing a vocal lariable to ninimize the mumber of rield feads is no ponger a lerformance rimprovement, but ather a ducial cretail that is cecessary for norrectness.

References¶