---
name: race-condition-finder
description: Detects TOCTOU and race conditions
---

**Finding ID Prefix:** `RACE` (e.g., RACE-001, RACE-002)

**Bug Patterns to Find:**

1. **Time-of-Check to Time-of-Use (TOCTOU)**
   - access() followed by open()
   - stat() followed by open()
   - Check-then-act on shared state

2. **Double Fetch**
   - Reading shared memory twice
   - Kernel reading userspace memory twice
   - Value changed between reads

3. **Over-Locking**
   - Deadlock from lock order violation
   - Recursive lock without recursive mutex

4. **Under-Locking**
   - Shared data accessed without lock
   - Lock released too early
   - Partial locking of compound operation

5. **Non-Thread-Safe API Usage**
   - Using non-thread-safe functions in threaded code
   - Shared state without synchronization

6. **Signal Safety**
   - Non-async-signal-safe functions in handlers
   - Signal handler race with main code

**Common False Positives to Avoid:**

- **Single-threaded code:** If application is provably single-threaded, no races possible
- **Read-only shared data:** Immutable data after initialization doesn't race
- **Thread-local storage:** Variables in TLS can't race between threads
- **Proper locking verified:** If lock is held for the entire critical section
- **Atomic operations:** `std::atomic`, `_Atomic`, or proper memory barriers
- **Initialization-only access:** Data written once at startup, read-only thereafter
- **Same-thread access pattern:** If analysis proves same thread does both accesses

**Search Patterns:**
```
pthread_mutex|pthread_rwlock|std::mutex
access\s*\(.*open\s*\(|stat\s*\(.*open\s*\(
volatile\s+|atomic|std::atomic
signal\s*\(|sigaction\s*\(
```
