Skip to content

Commit 9dc724b

Browse files
NateD-MSFTNateD-MSFT
authored
Merge pull request #138 from microsoft/development
RI of development branch to main (03/29/24)
2 parents 49e1d7b + 35782fd commit 9dc724b

36 files changed

Lines changed: 2345 additions & 83 deletions

‎.github/workflows/build-codeql.yaml‎

Lines changed: 46 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# Continuous integration action for the CodeQL components of this repo.
22
# This downloads the CodeQL CLI and then builds all the queries in the "windows-drivers" folder.
33

4-
name: Build Windows CodeQL queries
4+
name: Build and Publish Windows CodeQL queries
55

66
on:
77
# Triggers the workflow on push or pull request events but only for the main and development branches
@@ -14,19 +14,22 @@ on:
1414
workflow_dispatch:
1515

1616
jobs:
17-
build:
17+
build-publish:
1818
runs-on: windows-latest
19-
19+
permissions:
20+
contents: read
21+
packages: write
2022
steps:
2123
- name: Enable long git paths
2224
shell: cmd
2325
run: git config --global core.longpaths true
2426

2527
- name: Clone self (windows-driver-developer-supplemental-tools)
26-
uses: actions/checkout@v2
28+
uses: actions/checkout@v4
2729
with:
2830
path: .
29-
31+
fetch-depth: 0
32+
3033
- name: Download CodeQL CLI
3134
uses: i3h/download-release-asset@v1.2.0
3235
with:
@@ -53,7 +56,7 @@ jobs:
5356
run: .\codeql-cli\codeql.exe version
5457

5558
- name: Setup Python
56-
uses: actions/setup-python@v2
59+
uses: actions/setup-python@v5
5760
with:
5861
python-version: 3.11
5962

@@ -66,6 +69,7 @@ jobs:
6669

6770
- name: Run test script
6871
shell: pwsh
72+
continue-on-error: true # Allow script to return non-zero exit code
6973
env:
7074
CONNECTION_STRING: ${{ secrets.CONNECTION_STRING }}
7175
ACCOUNT_KEY: ${{ secrets.ACCOUNT_KEY }}
@@ -91,4 +95,39 @@ jobs:
9195
shell: cmd
9296
run: .\codeql-cli\codeql.cmd query compile --check-only .\src
9397

94-
98+
- name: Check for changes to qlpack
99+
shell: pwsh
100+
run:
101+
$qlpack_diff = git diff HEAD~1:src/qlpack.yml src/qlpack.yml;
102+
$rec_diff = git diff HEAD~1:src/windows-driver-suites/windows_recommended_partial.qls src/windows-driver-suites/windows_recommended_partial.qls;
103+
$mf_diff = git diff HEAD~1:src/windows-driver-suites/windows_mustfix_partial.qls src/windows-driver-suites/windows_mustfix_partial.qls;
104+
if (!$qlpack_diff -and ($rec_diff -or $mf_diff)) { "Query suite file updated without updating qlpack version"; exit 1 }
105+
106+
$last_qlpack_commit = git log -n 1 --pretty=format:%H -- src/qlpack.yml;
107+
$qlpack_changes =git show $last_qlpack_commit -- .\src\qlpack.yml;
108+
109+
$last_mf_commit = git log -n 1 --pretty=format:%H -- src/windows-driver-suites/windows_mustfix_partial.qls;
110+
$last_rec_commit = git log -n 1 --pretty=format:%H -- src/windows-driver-suites/windows_recommended_partial.qls;
111+
$commits_since_qlpack_change = [int](git rev-list --count HEAD...$last_qlpack_commit);
112+
$commits_since_mf_change = [int](git rev-list --count HEAD...$last_mf_commit);
113+
$commits_since_rec_change = [int](git rev-list --count HEAD...$last_rec_commit);
114+
115+
if ($commits_since_qlpack_change -gt $commits_since_mf_change) { "Mustfix query suite file modified without updating version"; exit 1 };
116+
if ($commits_since_qlpack_change -gt $commits_since_rec_change) {"Recommended query suite file modified without updating version"; exit 1 };
117+
118+
try{$old_qlpack_version = [version]($qlpack_changes -match "-version").Substring(10);} catch {"Changed qlpack.yml without updating version"; exit 1 }
119+
try{$new_qlpack_version = [version]($qlpack_changes -match "\+version").Substring(10);} catch {"Changed qlpack.yml without updating version"; exit 1 }
120+
if ($new_qlpack_version -gt $old_qlpack_version) { exit 0 } else { "qlpack.yml version not incremented"; exit 1 }
121+
122+
- name: Publish New CodeQL Pack
123+
shell: pwsh
124+
env:
125+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
126+
127+
run:
128+
$build = git rev-parse --short HEAD;
129+
$version =( Select-String .\src\qlpack.yml -Pattern "version").line;
130+
$new_ver = "$version-alpha+$build";
131+
(Get-Content .\src\qlpack.yml).Replace($version, $new_ver) | Set-Content .\src\qlpack.yml;
132+
.\codeql-cli\codeql.cmd pack publish --allow-prerelease ./src;
133+

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ Debug/*
88

99
src/drivers/test/**/driver/Debug/*
1010
src/drivers/test/**/driver/x64/*
11+
src/drivers/test/**/x64/*
12+
src/drivers/test/**/Debug/*
1113
src/drivers/test/TestDB/*
1214
src/drivers/test/working/*
1315
src/drivers/test/AnalysisFiles/*

‎README.md‎

Lines changed: 18 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -4,20 +4,20 @@ This repository contains open-source components for supplemental use in developi
44

55
### For General Use
66

7-
| CodeQL CLI version | microsoft/windows-drivers qlpack version |Associated Repo Branch|
8-
|--------------------------|-------------------------------------------|------------------------|
9-
| 2.15.4 | latest |main |
7+
| CodeQL CLI version | microsoft/windows-drivers qlpack version | codeql/cpp-queries version |Associated Repo Branch|
8+
|--------------------------|-------------------------------------------|------------------------|------------------------|
9+
| 2.15.4 | latest | latest |main |
1010

1111
### For Windows Hardware Compatibility Program Use
1212

1313
### Windows Hardware Compatibility Program Release Version Matrix
14-
| Release | CodeQL CLI version | microsoft/windows-drivers qlpack version|Associated Repo Branch|
15-
|--------------------------|--------------------|-----------------------------------------|----------------------|
16-
| Windows Server 2022 | [2.4.6](https://github.com/github/codeql-cli-binaries/releases/tag/v2.4.6) or [2.15.4](https://github.com/github/codeql-cli-binaries/releases/tag/v2.15.4)| 1.0.13 (If using codeql 2.15.4)|WHCP_21H2 |
17-
| Windows 11 | [2.4.6](https://github.com/github/codeql-cli-binaries/releases/tag/v2.4.6) or [2.15.4](https://github.com/github/codeql-cli-binaries/releases/tag/v2.15.4)| 1.0.13 (If using codeql 2.15.4)|WHCP_21H2|
18-
| Windows 11, version 22H2 | [2.6.3](https://github.com/github/codeql-cli-binaries/releases/tag/v2.6.3) or [2.15.4](https://github.com/github/codeql-cli-binaries/releases/tag/v2.15.4)| 1.0.13 (If using codeql 2.15.4)|WHCP_22H2|
19-
| Windows 11, version 23H2 | [2.6.3](https://github.com/github/codeql-cli-binaries/releases/tag/v2.6.3) or [2.15.4](https://github.com/github/codeql-cli-binaries/releases/tag/v2.15.4)| 1.0.13 (If using codeql 2.15.4)|WHCP_22H2|
20-
| Windows 11, version 24H2 | [2.15.4](https://github.com/github/codeql-cli-binaries/releases/tag/v2.15.4) | 1.1.0 | WHCP_24H2 |
14+
| Release | CodeQL CLI version | microsoft/windows-drivers qlpack version| codeql/cpp-queries version | Associated Repo Branch|
15+
|--------------------------|--------------------|-----------------------------------------|----------------------|-----------------------------|
16+
| Windows Server 2022 | [2.4.6](https://github.com/github/codeql-cli-binaries/releases/tag/v2.4.6) or [2.15.4](https://github.com/github/codeql-cli-binaries/releases/tag/v2.15.4)| 1.0.13 (If using codeql 2.15.4)| 0.9.0 (If using codeql 2.15.4) | WHCP_21H2|
17+
| Windows 11 | [2.4.6](https://github.com/github/codeql-cli-binaries/releases/tag/v2.4.6) or [2.15.4](https://github.com/github/codeql-cli-binaries/releases/tag/v2.15.4)| 1.0.13 (If using codeql 2.15.4)| 0.9.0 (If using codeql 2.15.4)|WHCP_21H2|
18+
| Windows 11, version 22H2 | [2.6.3](https://github.com/github/codeql-cli-binaries/releases/tag/v2.6.3) or [2.15.4](https://github.com/github/codeql-cli-binaries/releases/tag/v2.15.4)| 1.0.13 (If using codeql 2.15.4)| 0.9.0 (If using codeql 2.15.4)|WHCP_22H2|
19+
| Windows 11, version 23H2 | [2.6.3](https://github.com/github/codeql-cli-binaries/releases/tag/v2.6.3) or [2.15.4](https://github.com/github/codeql-cli-binaries/releases/tag/v2.15.4)| 1.0.13 (If using codeql 2.15.4)| 0.9.0 (If using codeql 2.15.4)|WHCP_22H2|
20+
| Windows 11, version 24H2 | [2.15.4](https://github.com/github/codeql-cli-binaries/releases/tag/v2.15.4) | 1.1.0 | 0.9.0 | WHCP_24H2 |
2121

2222

2323

@@ -69,14 +69,18 @@ This repository contains open-source components for supplemental use in developi
6969
7070
**Note:** It is no longer necessary to clone the Windows-Driver-Developer-Supplemental-Tools repo to use the queries for certification.
7171
72-
Download the correct version of the microsoft/windows-drivers pack from the Windows Hardware Compatibility Program Release Version Matrix:
73-
```
72+
Download the correct version of the CodeQL packs from the Windows Hardware Compatibility Program Release Version Matrix:
73+
```
7474
codeql pack download microsoft/windows-drivers@<version>
7575
```
76+
77+
```
78+
codeql pack download codeql/cpp-queries@<version>
79+
```
7680
77-
CodeQL will install the microsoft/windows-drivers pack to the default directory `C:\Users\<current user>\.codeql\packages\microsoft\windows-drivers\<downloaded version>\`. Do not change this directory or move the installed pack.
81+
CodeQL will install the packs to the default directory `C:\Users\<current user>\.codeql\packages\microsoft\windows-drivers\<downloaded version>\`. Do not change this directory or move the installed pack.
7882
79-
For examples, if using WHCP_24H2, run the following command to download query pack:
83+
For examples, if using WHCP_24H2, run the following command to download query the microsoft/windows-drivers pack:
8084
8185
```
8286
codeql pack download microsoft/windows-drivers@1.1.0

‎src/drivers/general/queries/IrqlTooHigh/IrqlTooHigh.ql‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,15 @@
22
// Licensed under the MIT license.
33
/**
44
* @id cpp/drivers/irql-too-high
5-
* @name IRQL too high (C28120)
5+
* @name IRQL too high (C28121)
66
* @description A function annotated with IRQL requirements was called at an IRQL too high for the requirements.
77
* @platform Desktop
88
* @security.severity Low
99
* @feature.area Multiple
1010
* @impact Exploitable Design
1111
* @repro.text The following function call is taking place at an IRQL too high for what the call target is annotated as.
1212
* @owner.email sdat@microsoft.com
13-
* @opaqueid CQLD-C28120
13+
* @opaqueid CQLD-C28121
1414
* @kind problem
1515
* @problem.severity warning
1616
* @precision medium

‎src/drivers/general/queries/IrqlTooHigh/IrqlTooHigh.sarif‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"driver" : {
77
"name" : "CodeQL",
88
"organization" : "GitHub",
9-
"semanticVersion" : "2.14.4",
9+
"semanticVersion" : "2.15.4",
1010
"notifications" : [ {
1111
"id" : "cpp/baseline/expected-extracted-files",
1212
"name" : "cpp/baseline/expected-extracted-files",
@@ -27,7 +27,7 @@
2727
"id" : "cpp/drivers/irql-too-high",
2828
"name" : "cpp/drivers/irql-too-high",
2929
"shortDescription" : {
30-
"text" : "IRQL too high (C28120)"
30+
"text" : "IRQL too high (C28121)"
3131
},
3232
"fullDescription" : {
3333
"text" : "A function annotated with IRQL requirements was called at an IRQL too high for the requirements."
@@ -43,8 +43,8 @@
4343
"id" : "cpp/drivers/irql-too-high",
4444
"impact" : "Exploitable Design",
4545
"kind" : "problem",
46-
"name" : "IRQL too high (C28120)",
47-
"opaqueid" : "CQLD-C28120",
46+
"name" : "IRQL too high (C28121)",
47+
"opaqueid" : "CQLD-C28121",
4848
"owner.email" : "sdat@microsoft.com",
4949
"platform" : "Desktop",
5050
"precision" : "medium",
@@ -58,7 +58,7 @@
5858
},
5959
"extensions" : [ {
6060
"name" : "microsoft/windows-drivers",
61-
"semanticVersion" : "0.2.0+4842fd4116871d3b47eede85c2c4497b43c34d57",
61+
"semanticVersion" : "1.1.0+2affc3c634804dac7504a483a378cc9ba22a0f0b",
6262
"locations" : [ {
6363
"uri" : "file:///C:/codeql-home/Windows-Driver-Developer-Supplemental-Tools/src/",
6464
"description" : {

‎src/drivers/general/queries/IrqlTooLow/IrqlTooLow.ql‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,15 @@
22
// Licensed under the MIT license.
33
/**
44
* @id cpp/drivers/irql-too-low
5-
* @name IRQL too low (C28121)
5+
* @name IRQL too low (C28120)
66
* @description A function annotated with IRQL requirements was called at an IRQL too low for the requirements.
77
* @platform Desktop
88
* @security.severity Low
99
* @feature.area Multiple
1010
* @impact Exploitable Design
1111
* @repro.text The following function call is taking place at an IRQL too low for what the call target is annotated as.
1212
* @owner.email sdat@microsoft.com
13-
* @opaqueid CQLD-C28121
13+
* @opaqueid CQLD-C28120
1414
* @kind problem
1515
* @problem.severity warning
1616
* @precision medium

‎src/drivers/general/queries/IrqlTooLow/IrqlTooLow.sarif‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"driver" : {
77
"name" : "CodeQL",
88
"organization" : "GitHub",
9-
"semanticVersion" : "2.14.4",
9+
"semanticVersion" : "2.15.4",
1010
"notifications" : [ {
1111
"id" : "cpp/baseline/expected-extracted-files",
1212
"name" : "cpp/baseline/expected-extracted-files",
@@ -27,7 +27,7 @@
2727
"id" : "cpp/drivers/irql-too-low",
2828
"name" : "cpp/drivers/irql-too-low",
2929
"shortDescription" : {
30-
"text" : "IRQL too low (C28121)"
30+
"text" : "IRQL too low (C28120)"
3131
},
3232
"fullDescription" : {
3333
"text" : "A function annotated with IRQL requirements was called at an IRQL too low for the requirements."
@@ -43,8 +43,8 @@
4343
"id" : "cpp/drivers/irql-too-low",
4444
"impact" : "Exploitable Design",
4545
"kind" : "problem",
46-
"name" : "IRQL too low (C28121)",
47-
"opaqueid" : "CQLD-C28121",
46+
"name" : "IRQL too low (C28120)",
47+
"opaqueid" : "CQLD-C28120",
4848
"owner.email" : "sdat@microsoft.com",
4949
"platform" : "Desktop",
5050
"precision" : "medium",
@@ -58,7 +58,7 @@
5858
},
5959
"extensions" : [ {
6060
"name" : "microsoft/windows-drivers",
61-
"semanticVersion" : "0.2.0+4842fd4116871d3b47eede85c2c4497b43c34d57",
61+
"semanticVersion" : "1.1.0+2affc3c634804dac7504a483a378cc9ba22a0f0b",
6262
"locations" : [ {
6363
"uri" : "file:///C:/codeql-home/Windows-Driver-Developer-Supplemental-Tools/src/",
6464
"description" : {

‎src/drivers/general/queries/MultithreadedAVCondition/MultithreadedAVCondition.qhelp‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
2+
<qhelp>
3+
<overview>
4+
<p>
5+
This warning indicates that a thread has potential to access deleted objects if preempted. Unlike the Code Analysis version of this query, this query does not currently verify the use of any synchronization mechanisms, so it may produce false positives.
6+
</p>
7+
</overview>
8+
<recommendation>
9+
<p>
10+
There should be no access to a reference-counted object after the reference count is at zero
11+
</p>
12+
</recommendation>
13+
<example>
14+
<p>
15+
In this example, m_cRef is a member of this. A thread T1 executes the if condition, decrements m_cRef to 1, and is then preempted. Another thread T2 executes the if condition, decrements m_cRef to 0, executes the if body (where this is deleted), and returns NULL.
16+
</p>
17+
<sample language="c"><![CDATA[
18+
ULONG Release_bad()
19+
{
20+
if (0 == InterlockedDecrement(&m_cRef))
21+
{
22+
delete this;
23+
return NULL;
24+
}
25+
/* this.m_cRef isn't thread safe */
26+
return m_cRef;
27+
}
28+
]]>
29+
</sample>
30+
<p>
31+
The following code does not reference any heap memory after the object is deleted.
32+
</p>
33+
<sample language="c"><![CDATA[
34+
ULONG CObject::Release()
35+
{
36+
ASSERT(0 != m_cRef);
37+
ULONG cRef = InterlockedDecrement(&m_cRef);
38+
if (0 == cRef)
39+
{
40+
delete this;
41+
return NULL;
42+
}
43+
return cRef;
44+
}
45+
]]>
46+
</sample>
47+
</example>
48+
<references>
49+
<li>
50+
<a href="https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/28616-multithreaded-av-condition">
51+
Warning C28616
52+
</a>
53+
</li>
54+
</references>
55+
</qhelp>

‎src/drivers/general/queries/MultithreadedAVCondition/MultithreadedAVCondition.ql‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
// Copyright (c) Microsoft Corporation.
2+
// Licensed under the MIT license.
3+
/**
4+
* @id cpp/drivers/multithreaded-av-condition
5+
* @name Multithreaded Access Violation Condition
6+
* @description This warning indicates that a thread has potential to access deleted objects if preempted.
7+
* @platform Desktop
8+
* @security.severity Medium
9+
* @feature.area Multiple
10+
* @impact Exploitable Design
11+
* @repro.text There should be no access to a reference-counted object after the reference count is at zero
12+
* @owner.email sdat@microsoft.com
13+
* @opaqueid CQLD-C28616
14+
* @kind problem
15+
* @problem.severity warning
16+
* @precision medium
17+
* @tags correctness
18+
* wddst
19+
* @scope domainspecific
20+
* @query-version v1
21+
*/
22+
23+
import cpp
24+
import semmle.code.cpp.ir.IR
25+
26+
from BasicBlock delBlock, BasicBlock useBlock, ThisExpr t, PointerFieldAccess p
27+
where
28+
exists(DeleteExpr del | del.getExpr() = t) and
29+
t.getEnclosingDeclaration() = p.getQualifier().getEnclosingDeclaration() and
30+
p.getEnclosingDeclaration() = t.getEnclosingDeclaration() and
31+
delBlock = t.getBasicBlock() and
32+
useBlock = p.getBasicBlock() and
33+
not useBlock.contains(delBlock) and
34+
not delBlock.contains(useBlock) and
35+
not delBlock.getAPredecessor*() = useBlock and
36+
delBlock.getAPredecessor*() = useBlock.getAPredecessor*()
37+
select p, "Possible Multithreaded Access Violation. Object deleted $@ but member $@ referenced", t, "here", p, p.toString()

0 commit comments

Comments
 (0)