diff --git a/src/drivers/general/queries/IrqlSetTooHigh/IrqlSetTooHigh.ql b/src/drivers/general/queries/IrqlSetTooHigh/IrqlSetTooHigh.ql index 7bd54b8d..56d32680 100644 --- a/src/drivers/general/queries/IrqlSetTooHigh/IrqlSetTooHigh.ql +++ b/src/drivers/general/queries/IrqlSetTooHigh/IrqlSetTooHigh.ql @@ -51,6 +51,7 @@ where tooHighForFunc(irqlFunc, otherNode, irqlRequirement) ) select statement, - "$@: IRQL potentially set too high at $@. Maximum IRQL for this function: " + irqlRequirement + - ", IRQL at statement: " + min(getPotentialExitIrqlAtCfn(statement)), irqlFunc, - irqlFunc.getQualifiedName(), statement, statement.toString() + "$@: " + irqlFunc.getQualifiedName() + " is annotated that it should never raise the IRQL above " + + irqlRequirement + ", but the statement $@ may set the IRQL to " + + min(getPotentialExitIrqlAtCfn(statement)), irqlFunc, irqlFunc.getQualifiedName(), statement, + statement.toString() diff --git a/src/drivers/general/queries/IrqlSetTooHigh/IrqlSetTooHigh.sarif b/src/drivers/general/queries/IrqlSetTooHigh/IrqlSetTooHigh.sarif index bd879f3f..c806a95a 100644 --- a/src/drivers/general/queries/IrqlSetTooHigh/IrqlSetTooHigh.sarif +++ b/src/drivers/general/queries/IrqlSetTooHigh/IrqlSetTooHigh.sarif @@ -1,425 +1,602 @@ { - "$schema" : "https://json.schemastore.org/sarif-2.1.0.json", - "version" : "2.1.0", - "runs" : [ { - "tool" : { - "driver" : { - "name" : "CodeQL", - "organization" : "GitHub", - "semanticVersion" : "2.14.4", - "notifications" : [ { - "id" : "cpp/baseline/expected-extracted-files", - "name" : "cpp/baseline/expected-extracted-files", - "shortDescription" : { - "text" : "Expected extracted files" - }, - "fullDescription" : { - "text" : "Files appearing in the source archive that are expected to be extracted." - }, - "defaultConfiguration" : { - "enabled" : true - }, - "properties" : { - "tags" : [ "expected-extracted-files", "telemetry" ] - } - } ], - "rules" : [ { - "id" : "cpp/drivers/irql-set-too-high", - "name" : "cpp/drivers/irql-set-too-high", - "shortDescription" : { - "text" : "IRQL set too high (C28150)" - }, - "fullDescription" : { - "text" : "A function annotated with a maximum IRQL for execution raises the IRQL above that amount." - }, - "defaultConfiguration" : { - "enabled" : true, - "level" : "warning" + "$schema": "https://json.schemastore.org/sarif-2.1.0.json", + "version": "2.1.0", + "runs": [ + { + "tool": { + "driver": { + "name": "CodeQL", + "organization": "GitHub", + "semanticVersion": "2.23.3", + "notifications": [ + { + "id": "cpp/baseline/expected-extracted-files", + "name": "cpp/baseline/expected-extracted-files", + "shortDescription": { + "text": "Expected extracted files" + }, + "fullDescription": { + "text": "Files appearing in the source archive that are expected to be extracted." + }, + "defaultConfiguration": { + "enabled": true + }, + "properties": { + "tags": [ + "expected-extracted-files", + "telemetry" + ] + } + }, + { + "id": "cli/platform", + "name": "cli/platform", + "shortDescription": { + "text": "Platform" + }, + "fullDescription": { + "text": "Platform" + }, + "defaultConfiguration": { + "enabled": true + } + }, + { + "id": "cpp/extractor/summary", + "name": "cpp/extractor/summary", + "shortDescription": { + "text": "C++ extractor telemetry" + }, + "fullDescription": { + "text": "C++ extractor telemetry" + }, + "defaultConfiguration": { + "enabled": true + } + } + ], + "rules": [ + { + "id": "cpp/drivers/irql-set-too-high", + "name": "cpp/drivers/irql-set-too-high", + "shortDescription": { + "text": "IRQL set too high (C28150)" + }, + "fullDescription": { + "text": "A function annotated with a maximum IRQL for execution raises the IRQL above that amount." + }, + "defaultConfiguration": { + "enabled": true, + "level": "warning" + }, + "properties": { + "tags": [ + "correctness", + "ca_ported", + "wddst" + ], + "description": "A function annotated with a maximum IRQL for execution raises the IRQL above that amount.", + "feature.area": "Multiple", + "id": "cpp/drivers/irql-set-too-high", + "impact": "Exploitable Design", + "kind": "problem", + "name": "IRQL set too high (C28150)", + "opaqueid": "CQLD-C28150", + "owner.email": "sdat@microsoft.com", + "platform": "Desktop", + "precision": "medium", + "problem.severity": "warning", + "query-version": "v1", + "repro.text": "The following statement exits at an IRQL too high for the function it is contained in.", + "scope": "domainspecific", + "security.severity": "Low" + } + } + ] + }, + "extensions": [ + { + "name": "microsoft/windows-drivers", + "semanticVersion": "1.8.1+801b2d9a470acb3a6f2beddebaff099855c9ac8e", + "locations": [ + { + "uri": "file:///D:/source/repos/Windows-Driver-Developer-Supplemental-Tools/src/", + "description": { + "text": "The QL pack root directory." + }, + "properties": { + "tags": [ + "CodeQL/LocalPackRoot" + ] + } + }, + { + "uri": "file:///D:/source/repos/Windows-Driver-Developer-Supplemental-Tools/src/qlpack.yml", + "description": { + "text": "The QL pack definition file." + }, + "properties": { + "tags": [ + "CodeQL/LocalPackDefinitionFile" + ] + } + } + ] }, - "properties" : { - "tags" : [ "correctness", "wddst" ], - "description" : "A function annotated with a maximum IRQL for execution raises the IRQL above that amount.", - "feature.area" : "Multiple", - "id" : "cpp/drivers/irql-set-too-high", - "impact" : "Exploitable Design", - "kind" : "problem", - "name" : "IRQL set too high (C28150)", - "opaqueid" : "CQLD-C28150", - "owner.email" : "sdat@microsoft.com", - "platform" : "Desktop", - "precision" : "medium", - "problem.severity" : "warning", - "query-version" : "v1", - "repro.text" : "The following statement exits at an IRQL too high for the function it is contained in.", - "scope" : "domainspecific", - "security.severity" : "Low" + { + "name": "codeql/cpp-all", + "semanticVersion": "4.2.0+2409bcc0d62644acbc432900bc59c2e3ff33bd56", + "locations": [ + { + "uri": "file:///C:/Users/natede/.codeql/packages/codeql/cpp-all/4.2.0/", + "description": { + "text": "The QL pack root directory." + }, + "properties": { + "tags": [ + "CodeQL/LocalPackRoot" + ] + } + }, + { + "uri": "file:///C:/Users/natede/.codeql/packages/codeql/cpp-all/4.2.0/qlpack.yml", + "description": { + "text": "The QL pack definition file." + }, + "properties": { + "tags": [ + "CodeQL/LocalPackDefinitionFile" + ] + } + } + ] } - } ] + ] }, - "extensions" : [ { - "name" : "microsoft/windows-drivers", - "semanticVersion" : "0.2.0+9e5ae32394a3e411584e20e992a697add48b30b5", - "locations" : [ { - "uri" : "file:///C:/codeql-home/Windows-Driver-Developer-Supplemental-Tools/src/", - "description" : { - "text" : "The QL pack root directory." - } - }, { - "uri" : "file:///C:/codeql-home/Windows-Driver-Developer-Supplemental-Tools/src/qlpack.yml", - "description" : { - "text" : "The QL pack definition file." - } - } ] - } ] - }, - "invocations" : [ { - "toolExecutionNotifications" : [ { - "locations" : [ { - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/driver_snippet.c", - "uriBaseId" : "%SRCROOT%", - "index" : 0 + "invocations": [ + { + "toolExecutionNotifications": [ + { + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "driver/driver_snippet.c", + "uriBaseId": "%SRCROOT%", + "index": 0 + } + } + } + ], + "message": { + "text": "" + }, + "level": "none", + "descriptor": { + "id": "cpp/baseline/expected-extracted-files", + "index": 0 + }, + "properties": { + "formattedMessage": { + "text": "" + } + } + }, + { + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "driver/fail_driver1.h", + "uriBaseId": "%SRCROOT%", + "index": 1 + } + } + } + ], + "message": { + "text": "" + }, + "level": "none", + "descriptor": { + "id": "cpp/baseline/expected-extracted-files", + "index": 0 + }, + "properties": { + "formattedMessage": { + "text": "" + } + } + }, + { + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "driver/fail_driver1.c", + "uriBaseId": "%SRCROOT%", + "index": 2 + } + } + } + ], + "message": { + "text": "" + }, + "level": "none", + "descriptor": { + "id": "cpp/baseline/expected-extracted-files", + "index": 0 + }, + "properties": { + "formattedMessage": { + "text": "" + } + } + }, + { + "message": { + "text": "On the Windows 11 (amd64; 10.0) platform.", + "markdown": "On the Windows 11 (amd64; 10.0) platform." + }, + "level": "none", + "timeUtc": "2026-01-23T07:54:15.471875500Z", + "descriptor": { + "id": "cli/platform", + "index": 1 + }, + "properties": { + "attributes": { + "arch": "amd64", + "name": "Windows 11", + "version": "10.0" + }, + "visibility": { + "statusPage": false, + "telemetry": true + } + } + }, + { + "message": { + "text": "Internal telemetry for the C++ extractor.\n\nNo action needed.", + "markdown": "Internal telemetry for the C++ extractor.\n\nNo action needed." + }, + "level": "note", + "timeUtc": "2026-01-23T15:54:25.920679Z", + "descriptor": { + "id": "cpp/extractor/summary", + "index": 2 + }, + "properties": { + "attributes": { + "cache-hits": 0, + "cache-misses": 1, + "compilers": [ + { + "program": "cl", + "version": "Microsoft (R) C/C++ Optimizing Compiler Version 19.44.35222 for x64" + } + ], + "extractor-failures": 1, + "extractor-successes": 0, + "trap-caching": "disabled" + }, + "visibility": { + "statusPage": false, + "telemetry": true + } + } } - } - } ], - "message" : { - "text" : "" - }, - "level" : "none", - "descriptor" : { - "id" : "cpp/baseline/expected-extracted-files", - "index" : 0 - }, - "properties" : { - "formattedMessage" : { - "text" : "" - } + ], + "executionSuccessful": true } - }, { - "locations" : [ { - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/fail_driver1.c", - "uriBaseId" : "%SRCROOT%", - "index" : 1 - } + ], + "artifacts": [ + { + "location": { + "uri": "driver/driver_snippet.c", + "uriBaseId": "%SRCROOT%", + "index": 0 } - } ], - "message" : { - "text" : "" - }, - "level" : "none", - "descriptor" : { - "id" : "cpp/baseline/expected-extracted-files", - "index" : 0 }, - "properties" : { - "formattedMessage" : { - "text" : "" + { + "location": { + "uri": "driver/fail_driver1.h", + "uriBaseId": "%SRCROOT%", + "index": 1 } - } - }, { - "locations" : [ { - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/fail_driver1.h", - "uriBaseId" : "%SRCROOT%", - "index" : 2 - } - } - } ], - "message" : { - "text" : "" - }, - "level" : "none", - "descriptor" : { - "id" : "cpp/baseline/expected-extracted-files", - "index" : 0 }, - "properties" : { - "formattedMessage" : { - "text" : "" + { + "location": { + "uri": "driver/fail_driver1.c", + "uriBaseId": "%SRCROOT%", + "index": 2 } } - } ], - "executionSuccessful" : true - } ], - "artifacts" : [ { - "location" : { - "uri" : "driver/driver_snippet.c", - "uriBaseId" : "%SRCROOT%", - "index" : 0 - } - }, { - "location" : { - "uri" : "driver/fail_driver1.c", - "uriBaseId" : "%SRCROOT%", - "index" : 1 - } - }, { - "location" : { - "uri" : "driver/fail_driver1.h", - "uriBaseId" : "%SRCROOT%", - "index" : 2 - } - } ], - "results" : [ { - "ruleId" : "cpp/drivers/irql-set-too-high", - "ruleIndex" : 0, - "rule" : { - "id" : "cpp/drivers/irql-set-too-high", - "index" : 0 - }, - "message" : { - "text" : "[CallFunctionThatRaisesIRQL_fail5](1): IRQL potentially set too high at [call to IrqlSetHigherFromPassive_pass0](2). Maximum IRQL for this function: 0, IRQL at statement: 2" - }, - "locations" : [ { - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/driver_snippet.c", - "uriBaseId" : "%SRCROOT%", - "index" : 0 + ], + "results": [ + { + "ruleId": "cpp/drivers/irql-set-too-high", + "ruleIndex": 0, + "rule": { + "id": "cpp/drivers/irql-set-too-high", + "index": 0 }, - "region" : { - "startLine" : 131, - "startColumn" : 5, - "endColumn" : 35 - } - } - } ], - "partialFingerprints" : { - "primaryLocationLineHash" : "50d7736bf7d9212d:1", - "primaryLocationStartColumnFingerprint" : "0" - }, - "relatedLocations" : [ { - "id" : 1, - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/driver_snippet.c", - "uriBaseId" : "%SRCROOT%", - "index" : 0 + "message": { + "text": "[CallFunctionThatRaisesIRQL_fail5](1): CallFunctionThatRaisesIRQL_fail5 is annotated that it should never raise the IRQL above 0, but the statement [call to IrqlSetHigherFromPassive_pass0](2) may set the IRQL to 2" }, - "region" : { - "startLine" : 129, - "startColumn" : 10, - "endColumn" : 42 - } - }, - "message" : { - "text" : "CallFunctionThatRaisesIRQL_fail5" - } - }, { - "id" : 2, - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/driver_snippet.c", - "uriBaseId" : "%SRCROOT%", - "index" : 0 + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "driver/driver_snippet.c", + "uriBaseId": "%SRCROOT%", + "index": 0 + }, + "region": { + "startLine": 131, + "startColumn": 5, + "endColumn": 35 + } + } + } + ], + "partialFingerprints": { + "primaryLocationLineHash": "50d7736bf7d9212d:1", + "primaryLocationStartColumnFingerprint": "0" }, - "region" : { - "startLine" : 131, - "startColumn" : 5, - "endColumn" : 35 - } + "relatedLocations": [ + { + "id": 1, + "physicalLocation": { + "artifactLocation": { + "uri": "driver/driver_snippet.c", + "uriBaseId": "%SRCROOT%", + "index": 0 + }, + "region": { + "startLine": 129, + "startColumn": 10, + "endColumn": 42 + } + }, + "message": { + "text": "CallFunctionThatRaisesIRQL_fail5" + } + }, + { + "id": 2, + "physicalLocation": { + "artifactLocation": { + "uri": "driver/driver_snippet.c", + "uriBaseId": "%SRCROOT%", + "index": 0 + }, + "region": { + "startLine": 131, + "startColumn": 5, + "endColumn": 35 + } + }, + "message": { + "text": "call to IrqlSetHigherFromPassive_pass0" + } + } + ] }, - "message" : { - "text" : "call to IrqlSetHigherFromPassive_pass0" - } - } ] - }, { - "ruleId" : "cpp/drivers/irql-set-too-high", - "ruleIndex" : 0, - "rule" : { - "id" : "cpp/drivers/irql-set-too-high", - "index" : 0 - }, - "message" : { - "text" : "[IrqlRaiseLevelExplicit_fail4](1): IRQL potentially set too high at [call to KfRaiseIrql](2). Maximum IRQL for this function: 0, IRQL at statement: 2" - }, - "locations" : [ { - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/driver_snippet.c", - "uriBaseId" : "%SRCROOT%", - "index" : 0 + { + "ruleId": "cpp/drivers/irql-set-too-high", + "ruleIndex": 0, + "rule": { + "id": "cpp/drivers/irql-set-too-high", + "index": 0 }, - "region" : { - "startLine" : 121, - "startColumn" : 5, - "endColumn" : 42 - } - } - } ], - "partialFingerprints" : { - "primaryLocationLineHash" : "b7bb153208f2004d:1", - "primaryLocationStartColumnFingerprint" : "0" - }, - "relatedLocations" : [ { - "id" : 1, - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/driver_snippet.c", - "uriBaseId" : "%SRCROOT%", - "index" : 0 + "message": { + "text": "[IrqlRaiseLevelExplicit_fail4](1): IrqlRaiseLevelExplicit_fail4 is annotated that it should never raise the IRQL above 0, but the statement [call to KfRaiseIrql](2) may set the IRQL to 2" }, - "region" : { - "startLine" : 118, - "startColumn" : 10, - "endColumn" : 38 - } - }, - "message" : { - "text" : "IrqlRaiseLevelExplicit_fail4" - } - }, { - "id" : 2, - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/driver_snippet.c", - "uriBaseId" : "%SRCROOT%", - "index" : 0 + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "driver/driver_snippet.c", + "uriBaseId": "%SRCROOT%", + "index": 0 + }, + "region": { + "startLine": 121, + "startColumn": 5, + "endColumn": 42 + } + } + } + ], + "partialFingerprints": { + "primaryLocationLineHash": "b7bb153208f2004d:1", + "primaryLocationStartColumnFingerprint": "0" }, - "region" : { - "startLine" : 121, - "startColumn" : 5, - "endColumn" : 42 - } + "relatedLocations": [ + { + "id": 1, + "physicalLocation": { + "artifactLocation": { + "uri": "driver/driver_snippet.c", + "uriBaseId": "%SRCROOT%", + "index": 0 + }, + "region": { + "startLine": 118, + "startColumn": 10, + "endColumn": 38 + } + }, + "message": { + "text": "IrqlRaiseLevelExplicit_fail4" + } + }, + { + "id": 2, + "physicalLocation": { + "artifactLocation": { + "uri": "driver/driver_snippet.c", + "uriBaseId": "%SRCROOT%", + "index": 0 + }, + "region": { + "startLine": 121, + "startColumn": 5, + "endColumn": 42 + } + }, + "message": { + "text": "call to KfRaiseIrql" + } + } + ] }, - "message" : { - "text" : "call to KfRaiseIrql" - } - } ] - }, { - "ruleId" : "cpp/drivers/irql-set-too-high", - "ruleIndex" : 0, - "rule" : { - "id" : "cpp/drivers/irql-set-too-high", - "index" : 0 - }, - "message" : { - "text" : "[IrqlRaiseLevelExplicit_fail3](1): IRQL potentially set too high at [call to KfRaiseIrql](2). Maximum IRQL for this function: 0, IRQL at statement: 2" - }, - "locations" : [ { - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/driver_snippet.c", - "uriBaseId" : "%SRCROOT%", - "index" : 0 + { + "ruleId": "cpp/drivers/irql-set-too-high", + "ruleIndex": 0, + "rule": { + "id": "cpp/drivers/irql-set-too-high", + "index": 0 }, - "region" : { - "startLine" : 112, - "startColumn" : 5, - "endColumn" : 42 - } - } - } ], - "partialFingerprints" : { - "primaryLocationLineHash" : "988957c55591351a:1", - "primaryLocationStartColumnFingerprint" : "0" - }, - "relatedLocations" : [ { - "id" : 1, - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/driver_snippet.c", - "uriBaseId" : "%SRCROOT%", - "index" : 0 + "message": { + "text": "[IrqlRaiseLevelExplicit_fail3](1): IrqlRaiseLevelExplicit_fail3 is annotated that it should never raise the IRQL above 0, but the statement [call to KfRaiseIrql](2) may set the IRQL to 2" }, - "region" : { - "startLine" : 109, - "startColumn" : 10, - "endColumn" : 38 - } - }, - "message" : { - "text" : "IrqlRaiseLevelExplicit_fail3" - } - }, { - "id" : 2, - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/driver_snippet.c", - "uriBaseId" : "%SRCROOT%", - "index" : 0 + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "driver/driver_snippet.c", + "uriBaseId": "%SRCROOT%", + "index": 0 + }, + "region": { + "startLine": 112, + "startColumn": 5, + "endColumn": 42 + } + } + } + ], + "partialFingerprints": { + "primaryLocationLineHash": "988957c55591351a:1", + "primaryLocationStartColumnFingerprint": "0" }, - "region" : { - "startLine" : 112, - "startColumn" : 5, - "endColumn" : 42 - } + "relatedLocations": [ + { + "id": 1, + "physicalLocation": { + "artifactLocation": { + "uri": "driver/driver_snippet.c", + "uriBaseId": "%SRCROOT%", + "index": 0 + }, + "region": { + "startLine": 109, + "startColumn": 10, + "endColumn": 38 + } + }, + "message": { + "text": "IrqlRaiseLevelExplicit_fail3" + } + }, + { + "id": 2, + "physicalLocation": { + "artifactLocation": { + "uri": "driver/driver_snippet.c", + "uriBaseId": "%SRCROOT%", + "index": 0 + }, + "region": { + "startLine": 112, + "startColumn": 5, + "endColumn": 42 + } + }, + "message": { + "text": "call to KfRaiseIrql" + } + } + ] }, - "message" : { - "text" : "call to KfRaiseIrql" - } - } ] - }, { - "ruleId" : "cpp/drivers/irql-set-too-high", - "ruleIndex" : 0, - "rule" : { - "id" : "cpp/drivers/irql-set-too-high", - "index" : 0 - }, - "message" : { - "text" : "[IrqlRaiseLevelExplicit_fail0](1): IRQL potentially set too high at [call to KfRaiseIrql](2). Maximum IRQL for this function: 1, IRQL at statement: 2" - }, - "locations" : [ { - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/driver_snippet.c", - "uriBaseId" : "%SRCROOT%", - "index" : 0 + { + "ruleId": "cpp/drivers/irql-set-too-high", + "ruleIndex": 0, + "rule": { + "id": "cpp/drivers/irql-set-too-high", + "index": 0 }, - "region" : { - "startLine" : 102, - "startColumn" : 5, - "endColumn" : 42 - } - } - } ], - "partialFingerprints" : { - "primaryLocationLineHash" : "71b218a9127ea6cb:1", - "primaryLocationStartColumnFingerprint" : "0" - }, - "relatedLocations" : [ { - "id" : 1, - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/driver_snippet.c", - "uriBaseId" : "%SRCROOT%", - "index" : 0 + "message": { + "text": "[IrqlRaiseLevelExplicit_fail0](1): IrqlRaiseLevelExplicit_fail0 is annotated that it should never raise the IRQL above 1, but the statement [call to KfRaiseIrql](2) may set the IRQL to 2" }, - "region" : { - "startLine" : 99, - "startColumn" : 10, - "endColumn" : 38 - } - }, - "message" : { - "text" : "IrqlRaiseLevelExplicit_fail0" - } - }, { - "id" : 2, - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/driver_snippet.c", - "uriBaseId" : "%SRCROOT%", - "index" : 0 + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "driver/driver_snippet.c", + "uriBaseId": "%SRCROOT%", + "index": 0 + }, + "region": { + "startLine": 102, + "startColumn": 5, + "endColumn": 42 + } + } + } + ], + "partialFingerprints": { + "primaryLocationLineHash": "71b218a9127ea6cb:1", + "primaryLocationStartColumnFingerprint": "0" }, - "region" : { - "startLine" : 102, - "startColumn" : 5, - "endColumn" : 42 - } - }, - "message" : { - "text" : "call to KfRaiseIrql" + "relatedLocations": [ + { + "id": 1, + "physicalLocation": { + "artifactLocation": { + "uri": "driver/driver_snippet.c", + "uriBaseId": "%SRCROOT%", + "index": 0 + }, + "region": { + "startLine": 99, + "startColumn": 10, + "endColumn": 38 + } + }, + "message": { + "text": "IrqlRaiseLevelExplicit_fail0" + } + }, + { + "id": 2, + "physicalLocation": { + "artifactLocation": { + "uri": "driver/driver_snippet.c", + "uriBaseId": "%SRCROOT%", + "index": 0 + }, + "region": { + "startLine": 102, + "startColumn": 5, + "endColumn": 42 + } + }, + "message": { + "text": "call to KfRaiseIrql" + } + } + ] } - } ] - } ], - "columnKind" : "utf16CodeUnits", - "properties" : { - "semmle.formatSpecifier" : "sarifv2.1.0" + ], + "columnKind": "utf16CodeUnits", + "properties": { + "semmle.formatSpecifier": "sarifv2.1.0" + } } - } ] -} + ] +} \ No newline at end of file diff --git a/src/drivers/general/queries/IrqlSetTooLow/IrqlSetTooLow.ql b/src/drivers/general/queries/IrqlSetTooLow/IrqlSetTooLow.ql index e1936c7c..d17de6fc 100644 --- a/src/drivers/general/queries/IrqlSetTooLow/IrqlSetTooLow.ql +++ b/src/drivers/general/queries/IrqlSetTooLow/IrqlSetTooLow.ql @@ -44,6 +44,7 @@ where tooLowForFunc(irqlFunc, otherNode, irqlRequirement) ) select statement, - "$@: IRQL potentially set too low at $@. Minimum IRQL for this function: " + irqlRequirement + - ", IRQL at statement: " + max(getPotentialExitIrqlAtCfn(statement)), irqlFunc, - irqlFunc.getQualifiedName(), statement, statement.toString() + "$@: " + irqlFunc.getQualifiedName() + " is annotated that it should never lower the IRQL below " + + irqlRequirement + ", but the statement $@ may set the IRQL to " + + max(getPotentialExitIrqlAtCfn(statement)), irqlFunc, irqlFunc.getQualifiedName(), statement, + statement.toString() diff --git a/src/drivers/general/queries/IrqlSetTooLow/IrqlSetTooLow.sarif b/src/drivers/general/queries/IrqlSetTooLow/IrqlSetTooLow.sarif index 60896f1e..b02509fa 100644 --- a/src/drivers/general/queries/IrqlSetTooLow/IrqlSetTooLow.sarif +++ b/src/drivers/general/queries/IrqlSetTooLow/IrqlSetTooLow.sarif @@ -1,362 +1,533 @@ { - "$schema" : "https://json.schemastore.org/sarif-2.1.0.json", - "version" : "2.1.0", - "runs" : [ { - "tool" : { - "driver" : { - "name" : "CodeQL", - "organization" : "GitHub", - "semanticVersion" : "2.14.4", - "notifications" : [ { - "id" : "cpp/baseline/expected-extracted-files", - "name" : "cpp/baseline/expected-extracted-files", - "shortDescription" : { - "text" : "Expected extracted files" - }, - "fullDescription" : { - "text" : "Files appearing in the source archive that are expected to be extracted." - }, - "defaultConfiguration" : { - "enabled" : true - }, - "properties" : { - "tags" : [ "expected-extracted-files", "telemetry" ] - } - } ], - "rules" : [ { - "id" : "cpp/drivers/irql-set-too-low", - "name" : "cpp/drivers/irql-set-too-low", - "shortDescription" : { - "text" : "IRQL set too low (C28124)" - }, - "fullDescription" : { - "text" : "A function annotated with a minimum IRQL for execution lowers the IRQL below that amount." - }, - "defaultConfiguration" : { - "enabled" : true, - "level" : "warning" + "$schema": "https://json.schemastore.org/sarif-2.1.0.json", + "version": "2.1.0", + "runs": [ + { + "tool": { + "driver": { + "name": "CodeQL", + "organization": "GitHub", + "semanticVersion": "2.23.3", + "notifications": [ + { + "id": "cpp/baseline/expected-extracted-files", + "name": "cpp/baseline/expected-extracted-files", + "shortDescription": { + "text": "Expected extracted files" + }, + "fullDescription": { + "text": "Files appearing in the source archive that are expected to be extracted." + }, + "defaultConfiguration": { + "enabled": true + }, + "properties": { + "tags": [ + "expected-extracted-files", + "telemetry" + ] + } + }, + { + "id": "cli/platform", + "name": "cli/platform", + "shortDescription": { + "text": "Platform" + }, + "fullDescription": { + "text": "Platform" + }, + "defaultConfiguration": { + "enabled": true + } + }, + { + "id": "cpp/extractor/summary", + "name": "cpp/extractor/summary", + "shortDescription": { + "text": "C++ extractor telemetry" + }, + "fullDescription": { + "text": "C++ extractor telemetry" + }, + "defaultConfiguration": { + "enabled": true + } + } + ], + "rules": [ + { + "id": "cpp/drivers/irql-set-too-low", + "name": "cpp/drivers/irql-set-too-low", + "shortDescription": { + "text": "IRQL set too low (C28124)" + }, + "fullDescription": { + "text": "A function annotated with a minimum IRQL for execution lowers the IRQL below that amount." + }, + "defaultConfiguration": { + "enabled": true, + "level": "warning" + }, + "properties": { + "tags": [ + "correctness", + "ca_ported", + "wddst" + ], + "description": "A function annotated with a minimum IRQL for execution lowers the IRQL below that amount.", + "feature.area": "Multiple", + "id": "cpp/drivers/irql-set-too-low", + "impact": "Exploitable Design", + "kind": "problem", + "name": "IRQL set too low (C28124)", + "opaqueid": "CQLD-C28124", + "owner.email": "sdat@microsoft.com", + "platform": "Desktop", + "precision": "medium", + "problem.severity": "warning", + "query-version": "v1", + "repro.text": "The following statement exits at an IRQL too low for the function it is contained in.", + "scope": "domainspecific", + "security.severity": "Low" + } + } + ] + }, + "extensions": [ + { + "name": "microsoft/windows-drivers", + "semanticVersion": "1.8.1+801b2d9a470acb3a6f2beddebaff099855c9ac8e", + "locations": [ + { + "uri": "file:///D:/source/repos/Windows-Driver-Developer-Supplemental-Tools/src/", + "description": { + "text": "The QL pack root directory." + }, + "properties": { + "tags": [ + "CodeQL/LocalPackRoot" + ] + } + }, + { + "uri": "file:///D:/source/repos/Windows-Driver-Developer-Supplemental-Tools/src/qlpack.yml", + "description": { + "text": "The QL pack definition file." + }, + "properties": { + "tags": [ + "CodeQL/LocalPackDefinitionFile" + ] + } + } + ] }, - "properties" : { - "tags" : [ "correctness", "wddst" ], - "description" : "A function annotated with a minimum IRQL for execution lowers the IRQL below that amount.", - "feature.area" : "Multiple", - "id" : "cpp/drivers/irql-set-too-low", - "impact" : "Exploitable Design", - "kind" : "problem", - "name" : "IRQL set too low (C28124)", - "opaqueid" : "CQLD-C28124", - "owner.email" : "sdat@microsoft.com", - "platform" : "Desktop", - "precision" : "medium", - "problem.severity" : "warning", - "query-version" : "v1", - "repro.text" : "The following statement exits at an IRQL too low for the function it is contained in.", - "scope" : "domainspecific", - "security.severity" : "Low" + { + "name": "codeql/cpp-all", + "semanticVersion": "4.2.0+2409bcc0d62644acbc432900bc59c2e3ff33bd56", + "locations": [ + { + "uri": "file:///C:/Users/natede/.codeql/packages/codeql/cpp-all/4.2.0/", + "description": { + "text": "The QL pack root directory." + }, + "properties": { + "tags": [ + "CodeQL/LocalPackRoot" + ] + } + }, + { + "uri": "file:///C:/Users/natede/.codeql/packages/codeql/cpp-all/4.2.0/qlpack.yml", + "description": { + "text": "The QL pack definition file." + }, + "properties": { + "tags": [ + "CodeQL/LocalPackDefinitionFile" + ] + } + } + ] } - } ] + ] }, - "extensions" : [ { - "name" : "microsoft/windows-drivers", - "semanticVersion" : "0.2.0+9e5ae32394a3e411584e20e992a697add48b30b5", - "locations" : [ { - "uri" : "file:///C:/codeql-home/Windows-Driver-Developer-Supplemental-Tools/src/", - "description" : { - "text" : "The QL pack root directory." - } - }, { - "uri" : "file:///C:/codeql-home/Windows-Driver-Developer-Supplemental-Tools/src/qlpack.yml", - "description" : { - "text" : "The QL pack definition file." - } - } ] - } ] - }, - "invocations" : [ { - "toolExecutionNotifications" : [ { - "locations" : [ { - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/driver_snippet.c", - "uriBaseId" : "%SRCROOT%", - "index" : 0 + "invocations": [ + { + "toolExecutionNotifications": [ + { + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "driver/driver_snippet.c", + "uriBaseId": "%SRCROOT%", + "index": 0 + } + } + } + ], + "message": { + "text": "" + }, + "level": "none", + "descriptor": { + "id": "cpp/baseline/expected-extracted-files", + "index": 0 + }, + "properties": { + "formattedMessage": { + "text": "" + } + } + }, + { + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "driver/fail_driver1.h", + "uriBaseId": "%SRCROOT%", + "index": 1 + } + } + } + ], + "message": { + "text": "" + }, + "level": "none", + "descriptor": { + "id": "cpp/baseline/expected-extracted-files", + "index": 0 + }, + "properties": { + "formattedMessage": { + "text": "" + } + } + }, + { + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "driver/fail_driver1.c", + "uriBaseId": "%SRCROOT%", + "index": 2 + } + } + } + ], + "message": { + "text": "" + }, + "level": "none", + "descriptor": { + "id": "cpp/baseline/expected-extracted-files", + "index": 0 + }, + "properties": { + "formattedMessage": { + "text": "" + } + } + }, + { + "message": { + "text": "On the Windows 11 (amd64; 10.0) platform.", + "markdown": "On the Windows 11 (amd64; 10.0) platform." + }, + "level": "none", + "timeUtc": "2026-01-23T07:55:34.089258700Z", + "descriptor": { + "id": "cli/platform", + "index": 1 + }, + "properties": { + "attributes": { + "arch": "amd64", + "name": "Windows 11", + "version": "10.0" + }, + "visibility": { + "statusPage": false, + "telemetry": true + } + } + }, + { + "message": { + "text": "Internal telemetry for the C++ extractor.\n\nNo action needed.", + "markdown": "Internal telemetry for the C++ extractor.\n\nNo action needed." + }, + "level": "note", + "timeUtc": "2026-01-23T15:55:45.403761Z", + "descriptor": { + "id": "cpp/extractor/summary", + "index": 2 + }, + "properties": { + "attributes": { + "cache-hits": 0, + "cache-misses": 1, + "compilers": [ + { + "program": "cl", + "version": "Microsoft (R) C/C++ Optimizing Compiler Version 19.44.35222 for x64" + } + ], + "extractor-failures": 1, + "extractor-successes": 0, + "trap-caching": "disabled" + }, + "visibility": { + "statusPage": false, + "telemetry": true + } + } } - } - } ], - "message" : { - "text" : "" - }, - "level" : "none", - "descriptor" : { - "id" : "cpp/baseline/expected-extracted-files", - "index" : 0 - }, - "properties" : { - "formattedMessage" : { - "text" : "" - } + ], + "executionSuccessful": true } - }, { - "locations" : [ { - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/fail_driver1.c", - "uriBaseId" : "%SRCROOT%", - "index" : 1 - } + ], + "artifacts": [ + { + "location": { + "uri": "driver/driver_snippet.c", + "uriBaseId": "%SRCROOT%", + "index": 0 } - } ], - "message" : { - "text" : "" }, - "level" : "none", - "descriptor" : { - "id" : "cpp/baseline/expected-extracted-files", - "index" : 0 - }, - "properties" : { - "formattedMessage" : { - "text" : "" - } - } - }, { - "locations" : [ { - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/fail_driver1.h", - "uriBaseId" : "%SRCROOT%", - "index" : 2 - } + { + "location": { + "uri": "driver/fail_driver1.h", + "uriBaseId": "%SRCROOT%", + "index": 1 } - } ], - "message" : { - "text" : "" }, - "level" : "none", - "descriptor" : { - "id" : "cpp/baseline/expected-extracted-files", - "index" : 0 - }, - "properties" : { - "formattedMessage" : { - "text" : "" + { + "location": { + "uri": "driver/fail_driver1.c", + "uriBaseId": "%SRCROOT%", + "index": 2 } } - } ], - "executionSuccessful" : true - } ], - "artifacts" : [ { - "location" : { - "uri" : "driver/driver_snippet.c", - "uriBaseId" : "%SRCROOT%", - "index" : 0 - } - }, { - "location" : { - "uri" : "driver/fail_driver1.c", - "uriBaseId" : "%SRCROOT%", - "index" : 1 - } - }, { - "location" : { - "uri" : "driver/fail_driver1.h", - "uriBaseId" : "%SRCROOT%", - "index" : 2 - } - } ], - "results" : [ { - "ruleId" : "cpp/drivers/irql-set-too-low", - "ruleIndex" : 0, - "rule" : { - "id" : "cpp/drivers/irql-set-too-low", - "index" : 0 - }, - "message" : { - "text" : "[IrqlAlwaysMinAPC_fail](1): IRQL potentially set too low at [call to KeLowerIrql](2). Minimum IRQL for this function: 1, IRQL at statement: 0" - }, - "locations" : [ { - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/driver_snippet.c", - "uriBaseId" : "%SRCROOT%", - "index" : 0 + ], + "results": [ + { + "ruleId": "cpp/drivers/irql-set-too-low", + "ruleIndex": 0, + "rule": { + "id": "cpp/drivers/irql-set-too-low", + "index": 0 }, - "region" : { - "startLine" : 92, - "startColumn" : 5, - "endColumn" : 16 - } - } - } ], - "partialFingerprints" : { - "primaryLocationLineHash" : "8a19ae2477ed23d3:1", - "primaryLocationStartColumnFingerprint" : "0" - }, - "relatedLocations" : [ { - "id" : 1, - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/driver_snippet.c", - "uriBaseId" : "%SRCROOT%", - "index" : 0 + "message": { + "text": "[IrqlAlwaysMinAPC_fail](1): IrqlAlwaysMinAPC_fail is annotated that it should never lower the IRQL below 1, but the statement [call to KeLowerIrql](2) may set the IRQL to 0" }, - "region" : { - "startLine" : 90, - "startColumn" : 10, - "endColumn" : 31 - } - }, - "message" : { - "text" : "IrqlAlwaysMinAPC_fail" - } - }, { - "id" : 2, - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/driver_snippet.c", - "uriBaseId" : "%SRCROOT%", - "index" : 0 + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "driver/driver_snippet.c", + "uriBaseId": "%SRCROOT%", + "index": 0 + }, + "region": { + "startLine": 92, + "startColumn": 5, + "endColumn": 16 + } + } + } + ], + "partialFingerprints": { + "primaryLocationLineHash": "8a19ae2477ed23d3:1", + "primaryLocationStartColumnFingerprint": "0" }, - "region" : { - "startLine" : 92, - "startColumn" : 5, - "endColumn" : 16 - } + "relatedLocations": [ + { + "id": 1, + "physicalLocation": { + "artifactLocation": { + "uri": "driver/driver_snippet.c", + "uriBaseId": "%SRCROOT%", + "index": 0 + }, + "region": { + "startLine": 90, + "startColumn": 10, + "endColumn": 31 + } + }, + "message": { + "text": "IrqlAlwaysMinAPC_fail" + } + }, + { + "id": 2, + "physicalLocation": { + "artifactLocation": { + "uri": "driver/driver_snippet.c", + "uriBaseId": "%SRCROOT%", + "index": 0 + }, + "region": { + "startLine": 92, + "startColumn": 5, + "endColumn": 16 + } + }, + "message": { + "text": "call to KeLowerIrql" + } + } + ] }, - "message" : { - "text" : "call to KeLowerIrql" - } - } ] - }, { - "ruleId" : "cpp/drivers/irql-set-too-low", - "ruleIndex" : 0, - "rule" : { - "id" : "cpp/drivers/irql-set-too-low", - "index" : 0 - }, - "message" : { - "text" : "[IrqlMinDispatchLowerIrql_fail1](1): IRQL potentially set too low at [call to KeLowerIrql](2). Minimum IRQL for this function: 2, IRQL at statement: 1" - }, - "locations" : [ { - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/driver_snippet.c", - "uriBaseId" : "%SRCROOT%", - "index" : 0 + { + "ruleId": "cpp/drivers/irql-set-too-low", + "ruleIndex": 0, + "rule": { + "id": "cpp/drivers/irql-set-too-low", + "index": 0 }, - "region" : { - "startLine" : 59, - "startColumn" : 5, - "endColumn" : 16 - } - } - } ], - "partialFingerprints" : { - "primaryLocationLineHash" : "c6798a9b4760c05b:1", - "primaryLocationStartColumnFingerprint" : "0" - }, - "relatedLocations" : [ { - "id" : 1, - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/driver_snippet.c", - "uriBaseId" : "%SRCROOT%", - "index" : 0 + "message": { + "text": "[IrqlMinDispatchLowerIrql_fail1](1): IrqlMinDispatchLowerIrql_fail1 is annotated that it should never lower the IRQL below 2, but the statement [call to KeLowerIrql](2) may set the IRQL to 1" }, - "region" : { - "startLine" : 57, - "startColumn" : 10, - "endColumn" : 40 - } - }, - "message" : { - "text" : "IrqlMinDispatchLowerIrql_fail1" - } - }, { - "id" : 2, - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/driver_snippet.c", - "uriBaseId" : "%SRCROOT%", - "index" : 0 + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "driver/driver_snippet.c", + "uriBaseId": "%SRCROOT%", + "index": 0 + }, + "region": { + "startLine": 59, + "startColumn": 5, + "endColumn": 16 + } + } + } + ], + "partialFingerprints": { + "primaryLocationLineHash": "c6798a9b4760c05b:1", + "primaryLocationStartColumnFingerprint": "0" }, - "region" : { - "startLine" : 59, - "startColumn" : 5, - "endColumn" : 16 - } + "relatedLocations": [ + { + "id": 1, + "physicalLocation": { + "artifactLocation": { + "uri": "driver/driver_snippet.c", + "uriBaseId": "%SRCROOT%", + "index": 0 + }, + "region": { + "startLine": 57, + "startColumn": 10, + "endColumn": 40 + } + }, + "message": { + "text": "IrqlMinDispatchLowerIrql_fail1" + } + }, + { + "id": 2, + "physicalLocation": { + "artifactLocation": { + "uri": "driver/driver_snippet.c", + "uriBaseId": "%SRCROOT%", + "index": 0 + }, + "region": { + "startLine": 59, + "startColumn": 5, + "endColumn": 16 + } + }, + "message": { + "text": "call to KeLowerIrql" + } + } + ] }, - "message" : { - "text" : "call to KeLowerIrql" - } - } ] - }, { - "ruleId" : "cpp/drivers/irql-set-too-low", - "ruleIndex" : 0, - "rule" : { - "id" : "cpp/drivers/irql-set-too-low", - "index" : 0 - }, - "message" : { - "text" : "[IrqlMinDispatchLowerIrql_fail](1): IRQL potentially set too low at [{{ ... }}](2). Minimum IRQL for this function: 2, IRQL at statement: 1" - }, - "locations" : [ { - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/driver_snippet.c", - "uriBaseId" : "%SRCROOT%", - "index" : 0 + { + "ruleId": "cpp/drivers/irql-set-too-low", + "ruleIndex": 0, + "rule": { + "id": "cpp/drivers/irql-set-too-low", + "index": 0 }, - "region" : { - "startLine" : 42, - "endLine" : 44, - "endColumn" : 2 - } - } - } ], - "partialFingerprints" : { - "primaryLocationLineHash" : "83574f45ab0b5d97:1", - "primaryLocationStartColumnFingerprint" : "0" - }, - "relatedLocations" : [ { - "id" : 1, - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/driver_snippet.c", - "uriBaseId" : "%SRCROOT%", - "index" : 0 + "message": { + "text": "[IrqlMinDispatchLowerIrql_fail](1): IrqlMinDispatchLowerIrql_fail is annotated that it should never lower the IRQL below 2, but the statement [{ ... }](2) may set the IRQL to 1" }, - "region" : { - "startLine" : 41, - "startColumn" : 10, - "endColumn" : 39 - } - }, - "message" : { - "text" : "IrqlMinDispatchLowerIrql_fail" - } - }, { - "id" : 2, - "physicalLocation" : { - "artifactLocation" : { - "uri" : "driver/driver_snippet.c", - "uriBaseId" : "%SRCROOT%", - "index" : 0 + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "driver/driver_snippet.c", + "uriBaseId": "%SRCROOT%", + "index": 0 + }, + "region": { + "startLine": 42, + "endLine": 44, + "endColumn": 2 + } + } + } + ], + "partialFingerprints": { + "primaryLocationLineHash": "83574f45ab0b5d97:1", + "primaryLocationStartColumnFingerprint": "0" }, - "region" : { - "startLine" : 42, - "endLine" : 44, - "endColumn" : 2 - } - }, - "message" : { - "text" : "{{ ... }}" + "relatedLocations": [ + { + "id": 1, + "physicalLocation": { + "artifactLocation": { + "uri": "driver/driver_snippet.c", + "uriBaseId": "%SRCROOT%", + "index": 0 + }, + "region": { + "startLine": 41, + "startColumn": 10, + "endColumn": 39 + } + }, + "message": { + "text": "IrqlMinDispatchLowerIrql_fail" + } + }, + { + "id": 2, + "physicalLocation": { + "artifactLocation": { + "uri": "driver/driver_snippet.c", + "uriBaseId": "%SRCROOT%", + "index": 0 + }, + "region": { + "startLine": 42, + "endLine": 44, + "endColumn": 2 + } + }, + "message": { + "text": "{{ ... }}" + } + } + ] } - } ] - } ], - "columnKind" : "utf16CodeUnits", - "properties" : { - "semmle.formatSpecifier" : "sarifv2.1.0" + ], + "columnKind": "utf16CodeUnits", + "properties": { + "semmle.formatSpecifier": "sarifv2.1.0" + } } - } ] + ] } \ No newline at end of file diff --git a/src/drivers/general/queries/IrqlTooLow/IrqlTooLow.ql b/src/drivers/general/queries/IrqlTooLow/IrqlTooLow.ql index d6f6db68..9a016373 100644 --- a/src/drivers/general/queries/IrqlTooLow/IrqlTooLow.ql +++ b/src/drivers/general/queries/IrqlTooLow/IrqlTooLow.ql @@ -18,7 +18,7 @@ * ca_ported * wddst * @scope domainspecific - * @query-version v2 + * @query-version v3 */ import cpp @@ -34,7 +34,7 @@ where irqlFunc.(IrqlRequiresAnnotatedFunction).getIrqlLevel() = irqlRequirement ) and irqlRequirement != -1 and - irqlRequirement > getPotentialExitIrqlAtCfn(prior) + irqlRequirement > max(getPotentialExitIrqlAtCfn(prior)) select call, "$@: IRQL potentially too low at call to $@. Minimum IRQL for this call: " + irqlRequirement + ", IRQL at preceding node: " + max(getPotentialExitIrqlAtCfn(prior)), call.getControlFlowScope(), diff --git a/src/drivers/test/diff/IrqlSetTooLow.sarif b/src/drivers/test/diff/IrqlSetTooLow.sarif index 9bca4b04..dea8275e 100644 --- a/src/drivers/test/diff/IrqlSetTooLow.sarif +++ b/src/drivers/test/diff/IrqlSetTooLow.sarif @@ -1,7 +1,7 @@ { "all": { - "+": 1, - "-": 1 + "+": 0, + "-": 0 }, "error": { "+": 0, @@ -9,20 +9,9 @@ "codes": [] }, "warning": { - "+": 1, - "-": 1, - "codes": [ - [ - "cpp/drivers/irql-set-too-low [IrqlMinDispatchLowerIrql_fail](1): IRQL potentially set too low at [{ ... }](2). Minimum IRQL for this function: 2, IRQL at statement: 1", - 0, - 1 - ], - [ - "cpp/drivers/irql-set-too-low [IrqlMinDispatchLowerIrql_fail](1): IRQL potentially set too low at [{{ ... }}](2). Minimum IRQL for this function: 2, IRQL at statement: 1", - 1, - 0 - ] - ] + "+": 0, + "-": 0, + "codes": [] }, "note": { "+": 0, diff --git a/src/qlpack.yml b/src/qlpack.yml index e2af1602..fe3190a5 100644 --- a/src/qlpack.yml +++ b/src/qlpack.yml @@ -2,7 +2,7 @@ # Licensed under the MIT license. name: microsoft/windows-drivers -version: 1.8.1 +version: 1.8.2 dependencies: codeql/cpp-all: ^4.2.0 microsoft/cpp-queries: ^0.0.4