CONCURRENCY.DATARACE : Data Race

Summary

Multiple execution threads access a shared piece of data, and at least one of them changes the value of that data, without an explicit synchronization operation to separate the accesses.

CodeSonar infers proper synchronization primarily based on the assumption that accesses to shared memory occur in critical sections defined by the acquisition of mutex locks. In applications that use other synchronization patterns (such as producer/consumer), CodeSonar is likely to issue many false positive Data Race warnings.

Properties

WARNING_FILTER += allow class="Data Race"

Thread Entry Points

The Data Race analysis will treat a function f() as a thread entry point if f() is passed to any of the following, as described on the Concurrency Models: Thread Entry Points page.

• Standard program entry functions main(), WinMain().
• Functions specified with configuration parameters FORCE_THREAD_ENTRY_NAMES and THREAD_ENTRY_METHOD_NAMES
• Any function treated as a thread entry point function by CodeSonar:
  • any library function that is recognized as a thread entry point function because CodeSonar ships with a library model that identifies it as such, and
  • any function for which you have added a library model identifying it as a thread entry point function.
• Any function treated as a signal handler entry point function by CodeSonar:
  • any library function that is recognized as a signal handler entry point function because CodeSonar ships with a library model that identifies it as such, and
  • any function for which you have added a library model identifying it as a signal handler entry point function.

[For programs using object-oriented multithreading APIs only.] The Data Race analysis will treat an object method o.m() as a thread entry point if o is used in a location where a thead entry point is expected and m() matches a THREAD_ENTRY_METHOD_NAMES configuration file rule.

Example

#include <pthread.h>

int count;

void update_count(void){
    int tmp = count;                                             /* read without locking */
    tmp = tmp+1;
    count = tmp;       /* 'Data Race' warning issued here */     /* write without locking */
}

void *watch_Y(void *arg){
    while (1){
        /* If see a yellow object, then... */
        update_count();
        /* Do yellow-specific tasks. */
    }
}

void *watch_R(void *arg){
    while (1){
        /* If see a red object, then... */
        update_count();
        /* Do red-specific tasks. */
    }
}

int main(void) {
    pthread_t Y_pth, R_pth;
    int y_res, r_res = 0;
    int retval = 0;
    y_res = pthread_create(&Y_pth, NULL, watch_Y, "yellow");
    r_res = pthread_create(&R_pth, NULL, watch_R, "red");
    /* ... */
    if (!y_res)
        pthread_detach(Y_pth);
    if (!r_res)
        pthread_detach(R_pth);
    return y_res + r_res;
}

In a multithreaded environment, data races can occur in the body of update_count():

Note

Even if the Data Race warning class is enabled, CodeSonar will only perform checking for this class if there is at least one location in the project that invokes one the following threading primitives.

• A standard program entry function: main() or WinMain().
• Any function treated as a lock acquisition or lock release function by CodeSonar:
  • any library function that is recognized as a lock acquisition or lock release function because CodeSonar ships with a library model that identifies it as such, and
  • any function for which you have added a library model identifying it as a lock acquisition or lock release function.
• Any function specified with the LOCK_FUNCTIONS or UNLOCK_FUNCTIONS configuration file parameter.
• Any function treated as a thread entry point or signal handler entry point function by CodeSonar:
  • any library function that is recognized as a thread entry point or signal handler entry point function because CodeSonar ships with a library model that identifies it as such, and
  • any function for which you have added a library model identifying it as a thread entry point or signal handler entry point function.

Note in particular that identifying a function with configuration parameter FORCE_THREAD_ENTRY_NAMES or THREAD_ENTRY_METHOD_NAMES is not sufficient to ensure that Data Race checking will be performed.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.

• ASSUME_FUNCPTR_PARAMETERS_MAYBE_FREED
• ASSUME_FUNCPTR_PARAMETERS_MAYBE_INITIALIZED
• ASSUME_FUNCPTR_PARAMETERS_MAYBE_MODIFIED
• ASSUME_OTHER_PARAMETERS_MAYBE_FREED
• ASSUME_OTHER_PARAMETERS_MAYBE_INITIALIZED
• ASSUME_OTHER_PARAMETERS_MAYBE_MODIFIED
• ASSUME_UNDEFINED_PARAMETERS_MAYBE_FREED
• ASSUME_UNDEFINED_PARAMETERS_MAYBE_INITIALIZED
• ASSUME_UNDEFINED_PARAMETERS_MAYBE_MODIFIED
• ASSUME_VARARG_PARAMETERS_MAYBE_FREED
• ASSUME_VARARG_PARAMETERS_MAYBE_INITIALIZED
• ASSUME_VARARG_PARAMETERS_MAYBE_MODIFIED
• CALL_SITE_EXPANSIONS
• CALL_SITE_EXPANSION_BOUND
• CPU_SPEED_ADJUSTMENT
• DATA_RACE_BARRIER_PERIOD
• DATA_RACE_IGNORE_NAMES
• DATA_RACE_MAX_LOCKSETS_PER_MEM_ACCESS
• DATA_RACE_MAX_MEM_ACCESSES
• DATA_RACE_MAX_RELATED_PATHS
• DATA_RACE_PATH_FINDING_EFFORT
• DIV_BY_ZERO_CRASHES
• DIV_OVERFLOW_CRASHES
• DP_REFINEMENT_APPROXIMATE
• DP_REFINEMENT_APPROXIMATE_DISMISS
• DP_REFINEMENT_APPROXIMATE_DISMISS_TIMEOUT
• DP_REFINEMENT_APPROXIMATE_TIMEOUT
• DP_REFINEMENT_EXACT
• DP_REFINEMENT_EXACT_DISMISS
• DP_REFINEMENT_EXACT_DISMISS_TIMEOUT
• DP_REFINEMENT_EXACT_TIMEOUT
• EXPLORE_MORE_LOOP_PATHS
• EXPLORE_SELF_ASSIGNMENT
• FLOAT_IS_ADVERSARIAL
• FORCE_THREAD_ENTRY_NAMES
• FUNCTION_MAP
• FUNCTION_POINTER_RESOLUTION
• IGNORE_CPP_CODE
• IMPLICIT_INITIALIZER_ELT_LIMIT
• INFER_CONST
• LOCK_FUNCTIONS
• LOOP_COUNTER_DISTRUST
• MAX_ALLOCATION_SIZE
• MAX_ATTEMPTED_SIMILAR_PATHS
• MAX_CHECKED_FUNCTION_POINTER_RESOLVENTS
• MAX_CHECKED_INPUTS_PER_PROCEDURE
• MAX_CHECKS_PER_INPUT
• MAX_CHECK_COMPLEXITY
• MAX_CLOBBERED_FIELDS
• MAX_COPIED_FIELDS
• MAX_EXPRESSION_COMPLEXITY
• MAX_GLOBAL_CHECK_AGE
• MAX_MODIFIED_VALUES
• MAX_PERCENT_F_CHARACTERS
• MAX_PERCENT_LF_CHARACTERS
• MAX_POINTER_ANALYSIS_PASSES
• MAX_SIMILAR_PATHS
• MAX_SUMMARIES_PER_PROCEDURE
• MULTIPLE_THREADS_PER_ENTRY_PROCEDURE
• MUTEX_FAILURE_BEHAVIOR
• NULL_POINTER_DEREF_CRASHES
• NULL_SENTINEL_CHAR_SIZE
• PARAMETER_EVALUATION_ORDER
• PATH_FINDING_EFFORT
• PATH_SHORTENING_EFFORT
• REACHABILITY_ROOTS
• REPORT_IMPLIED_EQUALITY
• REPORT_IMPLIED_INEQUALITY
• REPORT_SIMILAR_WARNINGS
• ROLLBACK_SUMMARIES_ON_ABORT
• SEARCH_BOUND
• SEARCH_BOUND_NOISE_THRESHOLD
• SEMOPEN_FUNCTIONS
• SYSTEM_INCLUDE_PATHS
• THREAD_ENTRY_METHOD_NAMES
• TIME_LIMIT_DATA_RACE_PATH_SEARCH
• TIME_LIMIT_DATA_RACE_PATH_SEARCH_PER_PROCEDURE
• TIME_LIMIT_INTER_CLASSIFY
• TIME_LIMIT_INTRA_CLASSIFY
• TIME_LIMIT_INTRA_EXPLORE
• TIME_LIMIT_REFINE
• TIME_LIMIT_RESOLVE
• UNINITIALIZED_GLOBALS
• VOLATILE_TREATMENT
• WARNING_FILTER