Skip to content

Commit fa6d266

Browse files
IrqlInconsistentWithRequired: CodeQL port of C28166 (#159)
* CodeQL port of C28156 * updates from review
1 parent 3fb0ff0 commit fa6d266

File tree

4 files changed

+429
-0
lines changed

4 files changed

+429
-0
lines changed
Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
2+
<qhelp>
3+
<overview>
4+
<p>
5+
The actual IRQL is inconsistent with the required IRQL
6+
</p>
7+
</overview>
8+
<recommendation>
9+
<p>
10+
An _IRQL_requires_same_ annotation specifies that the driver should be executing at a particular IRQL when the function completes, but there is at least one path in which the driver is executing at a different IRQL when the function completes.
11+
</p>
12+
</recommendation>
13+
<example>
14+
<p>
15+
Function annotated with _IRQL_requires_same_ but can possibly exit at a different IRQL level.
16+
</p>
17+
<sample language="c"> <![CDATA[
18+
_IRQL_requires_same_ void fail1(PKIRQL oldIrql)
19+
{
20+
21+
if (oldIrql == PASSIVE_LEVEL)
22+
{
23+
KeLowerIrql(*oldIrql);
24+
}
25+
else
26+
{
27+
KeRaiseIrql(DISPATCH_LEVEL, oldIrql); // Function exits at DISPATCH_LEVEL
28+
}
29+
}
30+
}]]>
31+
32+
</example>
33+
<semmleNotes>
34+
<p>
35+
</p>
36+
</semmleNotes>
37+
<references>
38+
<li>
39+
<a href="https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/28166-function-does-not-restore-irql-value">
40+
C28166
41+
</a>
42+
</li>
43+
</references>
44+
</qhelp>
Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
// Copyright (c) Microsoft Corporation.
2+
// Licensed under the MIT license.
3+
/**
4+
* @id cpp/drivers/irql-inconsistent-with-required
5+
* @kind problem
6+
* @name Irql Inconsistent With Required
7+
* @description The actual IRQL is inconsistent with the required IRQL
8+
* @platform Desktop
9+
* @feature.area Multiple
10+
* @impact Insecure Coding Practice
11+
* @repro.text An _IRQL_requires_same_ annotation specifies that the driver should be executing at a particular IRQL when the function completes, but there is at least one path in which the driver is executing at a different IRQL when the function completes.
12+
* @owner.email: [email protected]
13+
* @opaqueid CQLD-C28166
14+
* @problem.severity warning
15+
* @precision medium
16+
* @tags correctness
17+
* @scope domainspecific
18+
* @query-version v1
19+
*/
20+
21+
import cpp
22+
import drivers.libraries.Irql
23+
24+
from
25+
IrqlRequiresSameAnnotatedFunction f, int irqlLevelEntry, int irqlLevelExit,
26+
ControlFlowNode exitCfn, ControlFlowNode entryCfn
27+
where
28+
exitCfn = f.getControlFlowScope() and
29+
entryCfn = f.getBlock() and
30+
irqlLevelEntry = getPotentialExitIrqlAtCfn(entryCfn) and
31+
irqlLevelExit = getPotentialExitIrqlAtCfn(exitCfn) and
32+
irqlLevelEntry != irqlLevelExit
33+
select f,
34+
"Possible IRQL level at function completion inconsistent with the required IRQL level for some path. Irql level expected: "
35+
+ irqlLevelEntry + ". Irql level found: " + irqlLevelExit +
36+
". Review the IRQL level of the function."

0 commit comments

Comments
 (0)