version: "1.0.0" name: kernel-locking-concurrency description: "Use when a Linux kernel PR diff touches locks, atomics, RCU, IRQs, or deferred work, concurrency audit (Sashiko stage 5): races, deadlocks, lock-context violations, missing barriers, RCU misuse. Every finding must name the two racing contexts. Part of the linux-kernel-review suite." license: Apache-2.0 metadata: author: Sashiko contributors / Chris Mason adapted_by: gvago source: https://github.com/sashiko-dev/sashiko (Apache-2.0), references from masoncl/review-prompts (MIT) variant: review version: 1.0.0

kernel-locking-concurrency

Lens for locking and synchronization audit (Sashiko stage 5). World-class concurrency review of the diff. This is the noisiest domain in kernel review, every finding must name the two racing contexts.

How to apply

• Identify every lock, RCU section, and lockless access the diff touches.
• For each concern, name context A, context B, and the interleaving that

breaks. If you cannot construct the interleaving, route the concern to kernel-review-discipline as speculative.

• Load references/locking.md for the full invariant catalog before deep

analysis; references/rcu.md whenever call_rcu/synchronize_rcu/kfree_rcu or RCU list ops appear.

Rule index

• C1. Sleeping in atomic context: mutex_lock, GFP_KERNEL allocation,

msleep, cond_resched, flush_workqueue, synchronize_rcu, cancel_work_sync under a spinlock, rwlock, or rcu_read_lock.

• C2. Lock ordering and deadlock: AB-BA orders, acquiring a lock already

held by a higher layer (e.g. ethtool), missing _irqsave when the lock is taken in hardirq context.

• C3. Races and lockless access: shared state touched without the owning

lock, missing smp_mb/smp_wmb/smp_rmb where lockless access is intended, TOCTOU where state is checked outside the lock and relied on inside.

• C4. Locking freed memory: unlock on freed objects; works/timers destroyed

after the subsystem that can still schedule them is gone; "initialized" flags set before private data is ready.

• C5. RCU rules: non-RCU-safe ops (list_splice_init) on RCU-protected

lists; list_for_each_rcu without rcu_read_lock; removal-vs-call_rcu ordering (see references/rcu.md).

• C6. Unprotected state modification: state checked before lock

acquisition, hardware state/flags/stats updated without protection.

• C7. Sequence counters: double counting inside u64_stats_fetch_retry

loops; interrupt reading a seqcount its own interrupted context writes.

• C8. Lock lifecycle: re-initializing a live lock; destroying a lock on a

failure path other paths still use.

• C9. Missing locking on publication: a port/file exposed to userspace

before linking completes; a worker racing cleanup.

Mapping a finding to the contract

• action_level: action_required for a constructed deadlock, sleep-in-atomic,

or race with memory corruption; remediation_recommended for inefficient but correct locking.

• category: Correctness (Security if the race is user-triggerable).
• evidence: both contexts, the shared object, the interleaving, lines.

What NOT to flag

• READ_ONCE absence when the data is protected by a lock currently held.
• Races that existing memory barriers or lock coverage already close ,

read references/locking.md before asserting a barrier is missing.

• Theoretical races with no constructible interleaving.

References (load only when needed)

• references/locking.md, full locking invariant catalog (512 lines).
• references/rcu.md, RCU lifecycle and list rules.

Sourcing

Stage text adapted from Sashiko (Apache-2.0). References reproduced from masoncl/review-prompts (MIT).