Add IrqlSetTooHigh, IrqlSetTooLow queries + update IRQL library #88
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Update cpp-all to 0.9.2, cpp-queries to 0.7.4
Still needs cleanup.
Signed-off-by: NateD-MSFT <[email protected]>
The changes to Irql.qll needed for IrqlSetTooHigh, etc. means we are more likely to see IRQL evaluations that return -1. Update queries to exclude those numbers.
Also refactor IrqlSetTooLow to match
Also refactor IrqlSetTooLow to match
…_snippet.c Co-authored-by: NateD-MSFT <[email protected]> Signed-off-by: Jacob Ronstadt <[email protected]>
…_snippet.c Co-authored-by: NateD-MSFT <[email protected]> Signed-off-by: Jacob Ronstadt <[email protected]>
…_snippet.c Co-authored-by: NateD-MSFT <[email protected]> Signed-off-by: Jacob Ronstadt <[email protected]>
…_snippet.c Co-authored-by: NateD-MSFT <[email protected]> Signed-off-by: Jacob Ronstadt <[email protected]>
Add tests for IrqlSetTooLow and IrqlSetTooHigh
Removes a false positive in our unit tests.
|
@JakobL-MSFT FYI. This does not yet contain the KeSetEvent-related query. This is getting all our existing IRQL-related checks+work into development with the intent of then building KeSetEvent off of that. @jacob-ronstadt The commits after be14ce4 are the work I've done since merging in your branch. You can see the diff by checking the commit-to-commit diff here. |
Signed-off-by: NateD-MSFT <[email protected]>
jacob-ronstadt
approved these changes
Oct 27, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds the following queries:
To support this, we expand the Irql.qll library (including making use of interprocedural analysis for functions that save/restore the IRQL). We also update the existing IrqlNotSaved and IrqlNotUsed checks to use the new data-flow analysis, which requires some tweaking to the queries but results in fewer false positives in our unit tests.
Note that because we previously squash merged the IRQL work this was based off of into development, early commits in this PR are redundant. bb06b89 onwards are relevant to this PR.
Checklist for Pull Requests
@versioncomment in the file header.codeql database createandcodeql database analyzehave completed successfully.