# Kernel Locking Concurrency

> Use when a Linux kernel PR diff touches locks, atomics, RCU, IRQs, or deferred work, concurrency audit (Sashiko stage 5): races, deadlocks, lock-context violations, missing barriers, RCU misuse. Every finding must name the two racing contexts. Part of the linux-kernel-review suite.

- Skill: `gvago/kernel-locking-concurrency` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add gvago/kernel-locking-concurrency`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gvago/kernel-locking-concurrency/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: Apache-2.0
- Author: gvago (https://skillmd.com/u/gvago)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/gvago/kernel-locking-concurrency

---


# kernel-locking-concurrency

Lens for locking and synchronization audit (Sashiko stage 5). World-class
concurrency review of the diff. This is the noisiest domain in kernel
review, every finding must name the two racing contexts.

## How to apply

- Identify every lock, RCU section, and lockless access the diff touches.
- For each concern, name context A, context B, and the interleaving that
  breaks. If you cannot construct the interleaving, route the concern to
  kernel-review-discipline as speculative.
- Load references/locking.md for the full invariant catalog before deep
  analysis; references/rcu.md whenever call_rcu/synchronize_rcu/kfree_rcu
  or RCU list ops appear.

## Rule index

- C1. Sleeping in atomic context: mutex_lock, GFP_KERNEL allocation,
  msleep, cond_resched, flush_workqueue, synchronize_rcu, cancel_work_sync
  under a spinlock, rwlock, or rcu_read_lock.
- C2. Lock ordering and deadlock: AB-BA orders, acquiring a lock already
  held by a higher layer (e.g. ethtool), missing _irqsave when the lock is
  taken in hardirq context.
- C3. Races and lockless access: shared state touched without the owning
  lock, missing smp_mb/smp_wmb/smp_rmb where lockless access is intended,
  TOCTOU where state is checked outside the lock and relied on inside.
- C4. Locking freed memory: unlock on freed objects; works/timers destroyed
  after the subsystem that can still schedule them is gone; "initialized"
  flags set before private data is ready.
- C5. RCU rules: non-RCU-safe ops (list_splice_init) on RCU-protected
  lists; list_for_each_rcu without rcu_read_lock; removal-vs-call_rcu
  ordering (see references/rcu.md).
- C6. Unprotected state modification: state checked before lock
  acquisition, hardware state/flags/stats updated without protection.
- C7. Sequence counters: double counting inside u64_stats_fetch_retry
  loops; interrupt reading a seqcount its own interrupted context writes.
- C8. Lock lifecycle: re-initializing a live lock; destroying a lock on a
  failure path other paths still use.
- C9. Missing locking on publication: a port/file exposed to userspace
  before linking completes; a worker racing cleanup.

## Mapping a finding to the contract

- action_level: action_required for a constructed deadlock, sleep-in-atomic,
  or race with memory corruption; remediation_recommended for inefficient
  but correct locking.
- category: Correctness (Security if the race is user-triggerable).
- evidence: both contexts, the shared object, the interleaving, lines.

## What NOT to flag

- READ_ONCE absence when the data is protected by a lock currently held.
- Races that existing memory barriers or lock coverage already close , 
  read references/locking.md before asserting a barrier is missing.
- Theoretical races with no constructible interleaving.

## References (load only when needed)

- references/locking.md, full locking invariant catalog (512 lines).
- references/rcu.md, RCU lifecycle and list rules.

## Sourcing

Stage text adapted from Sashiko (Apache-2.0). References reproduced from
masoncl/review-prompts (MIT).