detecting-race-conditions

Detecting race conditions

Race bugs don't live in one line - they live in the gap between two operations that another actor can slip through. There's no tainted value to trace and no single sink to grep; you find them by asking what state is shared, what runs concurrently, and where a window opens between deciding something and acting on it. This skill covers the recurring shapes and how to confirm a real window.

When to use

• Multithreaded / async / multiprocess code, or a shared resource (DB row, cache, counter, file, in-memory map) touched by concurrent requests.
• A "check then act" sequence where the check's truth can expire before the act: balance/quota checks, auth-then-use, uniqueness/dedup guards, file existence checks, one-time tokens.

Scope check

Authorized source only. If you can't name the authorization, stop.

The shapes and how to confirm each

Confirmation of a race is an interleaving witness: two concrete operation orders where one is safe and the other, achievable by an attacker, is not.

1. TOCTOU (time-of-check to time-of-use). State is validated, then used, and it can change in between. Classic filesystem form: access(path) / stat(path) then open(path) - a symlink swap in the window redirects the open. General form: any check(x); … ; use(x) where x (or what it names) is mutable by another actor in the gap. Confirm: identify the shared thing, show a writer that can change it between check and use.

2. Check-then-act on shared state without atomicity. "If not exists, create"; "if balance ≥ n, deduct n"; "if not already redeemed, redeem." Two requests both pass the check before either acts → double-spend, duplicate creation, coupon reuse. Confirm: two concurrent runs both read the pre-act value; neither the read+act is atomic (no transaction, lock, SELECT … FOR UPDATE, compare- and-swap, or unique constraint).

3. Unsynchronized shared mutable state. A field/map/counter read and written by multiple threads with no lock/atomic. Confirm: two threads reach the same memory, at least one writes, no happens-before relationship (no shared lock, no atomic, no ownership handoff) orders them.