Skip to content

Commit 2a7c167

Browse files
jacob-ronstadtjacob-ronstadt
authored
update uses of dataflow to use latest library (#155)
* update uses of dataflow to use latest library * fix dataflow use * bug fix * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <[email protected]> * update pack versions to fix false positive --------- Signed-off-by: Jacob Ronstadt <[email protected]>
1 parent 3ef295d commit 2a7c167

File tree

21 files changed

+185
-198
lines changed

21 files changed

+185
-198
lines changed

‎.github/workflows/build-codeql.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ on:
1414
workflow_dispatch:
1515

1616
env:
17-
CODEQL_VERSION: 2.15.4
17+
CODEQL_VERSION: 2.20.1
1818

1919
jobs:
2020
build:

‎src/codeql-pack.lock.yml‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,23 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/cpp-all:
5-
version: 0.12.1
5+
version: 3.1.0
66
codeql/dataflow:
7-
version: 0.1.4
7+
version: 1.1.8
8+
codeql/mad:
9+
version: 1.0.14
810
codeql/rangeanalysis:
9-
version: 0.0.3
11+
version: 1.0.14
1012
codeql/ssa:
11-
version: 0.2.4
13+
version: 1.0.14
1214
codeql/tutorial:
13-
version: 0.2.4
15+
version: 1.0.14
16+
codeql/typeflow:
17+
version: 1.0.14
1418
codeql/typetracking:
15-
version: 0.2.4
19+
version: 1.0.14
1620
codeql/util:
17-
version: 0.2.4
21+
version: 2.0.1
22+
codeql/xml:
23+
version: 1.0.14
1824
compiled: false

‎src/drivers/general/queries/FloatHardwareStateProtection/FloatHardwareStateProtection.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ class KernelFloatAnnotatedTypedef extends TypedefType {
3939
class KernelFloatAnnotatedFunction extends Function {
4040
KernelFloatFunctionAnnotation kernelFloatAnnotation;
4141

42-
cached
42+
4343
KernelFloatAnnotatedFunction() {
4444
(
4545
// this.hasCLinkage() and

‎src/drivers/general/queries/FloatSafeExit/FloatSafeExit.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ class KernelFloatAnnotatedTypedef extends TypedefType {
3939
class KernelFloatAnnotatedFunction extends Function {
4040
KernelFloatFunctionAnnotation kernelFloatAnnotation;
4141

42-
cached
42+
4343
KernelFloatAnnotatedFunction() {
4444
(
4545
// this.hasCLinkage() and

‎src/drivers/general/queries/FloatUnsafeExit/FloatUnsafeExit.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ class KernelFloatAnnotatedTypedef extends TypedefType {
3939
class KernelFloatAnnotatedFunction extends Function {
4040
KernelFloatFunctionAnnotation kernelFloatAnnotation;
4141

42-
cached
42+
4343
KernelFloatAnnotatedFunction() {
4444
(
4545
// this.hasCLinkage() and

‎src/drivers/general/queries/IrqlNotSaved/IrqlNotSaved.ql‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -23,21 +23,19 @@
2323
import cpp
2424
import drivers.libraries.Irql
2525
import semmle.code.cpp.dataflow.new.DataFlow
26-
import semmle.code.cpp.dataflow.new.DataFlow2
2726

2827
/**
2928
* A data-flow configuration describing flow from an
3029
* \_IRQL\_saves\_-annotated parameter to an OS function that restores
3130
* the IRQL.
3231
*/
33-
class IrqlFlowConfiguration extends DataFlow::Configuration {
34-
IrqlFlowConfiguration() { this = "IrqlFlowConfiguration" }
32+
module IrqlFlowConfigurationConfig implements DataFlow::ConfigSig {
3533

36-
override predicate isSource(DataFlow::Node source) {
34+
predicate isSource(DataFlow::Node source) {
3735
source.asParameter() instanceof IrqlSaveParameter
3836
}
3937

40-
override predicate isSink(DataFlow::Node sink) {
38+
predicate isSink(DataFlow::Node sink) {
4139
exists(FunctionCall fc, FundamentalIrqlSaveFunction fisf |
4240
fc.getTarget() = fisf and
4341
(
@@ -50,6 +48,8 @@ class IrqlFlowConfiguration extends DataFlow::Configuration {
5048
}
5149
}
5250

51+
module IrqlFlowConfiguration = DataFlow::Global<IrqlFlowConfigurationConfig>;
52+
5353
/**
5454
* A function that we know will restore the IRQL, i.e. one defined
5555
* by the Windows OS itself. This is in general in a Windows Kits header. For
@@ -75,38 +75,38 @@ class FundamentalIrqlSaveFunction extends IrqlSavesFunction {
7575
/**
7676
* A simple data flow from any IrqlSaveParameter.
7777
*/
78-
class IrqlSaveParameterFlowConfiguration extends DataFlow2::Configuration {
79-
IrqlSaveParameterFlowConfiguration() { this = "IrqlSaveParameterFlowConfiguration" }
78+
module IrqlSaveParameterFlowConfigurationConfig implements DataFlow::ConfigSig {
8079

81-
override predicate isSource(DataFlow::Node source) {
80+
predicate isSource(DataFlow::Node source) {
8281
source.asParameter() instanceof IrqlSaveParameter
8382
}
8483

85-
override predicate isSink(DataFlow::Node sink) { sink instanceof DataFlow::Node }
84+
predicate isSink(DataFlow::Node sink) { sink instanceof DataFlow::Node }
8685
}
86+
module IrqlSaveParameterFlowConfiguration = DataFlow::Global<IrqlSaveParameterFlowConfigurationConfig>;
87+
8788

8889
/**
8990
* A data-flow configuration representing flow from an
9091
* OS function that returns an IRQL to be saved to a parameter marked
9192
* \_IRQL\_saves\_ (or a variable aliasing that parameter.)
9293
*/
93-
class IrqlAssignmentFlowConfiguration extends DataFlow::Configuration {
94-
IrqlAssignmentFlowConfiguration() { this = "IrqlAssignmentFlowConfiguration" }
94+
module IrqlAssignmentFlowConfigurationConfig implements DataFlow::ConfigSig {
9595

96-
override predicate isSource(DataFlow::Node source) {
96+
predicate isSource(DataFlow::Node source) {
9797
source.asExpr() instanceof FunctionCall and
9898
source.asExpr().(FunctionCall).getTarget() instanceof FundamentalIrqlSaveFunction and
9999
source.asExpr().(FunctionCall).getTarget() instanceof IrqlSavesViaReturnFunction
100100
}
101101

102-
override predicate isSink(DataFlow::Node sink) {
102+
predicate isSink(DataFlow::Node sink) {
103103
exists(Assignment a |
104104
a.getLValue().getAChild*().(VariableAccess).getTarget() instanceof IrqlSaveVariableFlowedTo and
105105
a.getRValue() = sink.asExpr()
106106
)
107107
}
108108
}
109-
109+
module IrqlAssignmentFlowConfiguration = DataFlow::Global<IrqlAssignmentFlowConfigurationConfig>;
110110
/**
111111
* A variable that is either a parameter annotated \_IRQL\_saves\_
112112
* or a variable which contains the value from a parameter annotated as such.
@@ -116,14 +116,14 @@ class IrqlSaveVariableFlowedTo extends Variable {
116116

117117
IrqlSaveVariableFlowedTo() {
118118
exists(
119-
IrqlSaveParameterFlowConfiguration ispfc, DataFlow::Node parameter, DataFlow::Node assignment
119+
DataFlow::Node parameter, DataFlow::Node assignment
120120
|
121121
(
122122
this.getAnAssignedValue() = assignment.asExpr() or
123123
this = assignment.asParameter()
124124
) and
125125
parameter.asParameter() = isp and
126-
ispfc.hasFlow(parameter, assignment)
126+
IrqlSaveParameterFlowConfiguration::flow(parameter, assignment)
127127
)
128128
or
129129
this = isp
@@ -142,19 +142,19 @@ where
142142
*/
143143

144144
not exists(
145-
DataFlow::Node node, IrqlSaveVariableFlowedTo isvft, IrqlAssignmentFlowConfiguration iafc
145+
DataFlow::Node node, IrqlSaveVariableFlowedTo isvft
146146
|
147147
isvft.getSaveParameter() = isp and
148148
exists(Assignment a |
149149
a.getLValue().getAChild*().(VariableAccess).getTarget() = isvft and
150150
a.getRValue() = node.asExpr()
151151
) and
152-
iafc.hasFlow(_, node)
152+
IrqlAssignmentFlowConfiguration::flow(_, node)
153153
) and
154154
// Case two: is the IrqlSaveParameter passed into an OS function that will save a value to it?
155-
not exists(DataFlow::Node node, IrqlFlowConfiguration ifc |
155+
not exists(DataFlow::Node node |
156156
node.asParameter() = isp and
157-
ifc.hasFlow(node, _)
157+
IrqlFlowConfiguration::flow(node, _)
158158
)
159159
select isp, "The parameter $@ is annotated \"_IRQL_saves_\" but never has the IRQL saved to it.",
160160
isp, isp.getName()

‎src/drivers/general/queries/IrqlNotUsed/IrqlNotUsed.ql‎

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@
2323
import cpp
2424
import drivers.libraries.Irql
2525
import semmle.code.cpp.dataflow.new.DataFlow
26-
import semmle.code.cpp.dataflow.new.DataFlow2
2726

2827
/**
2928
* A function that has at least one parameter annotated with "\_IRQL\_restores\_".
@@ -61,14 +60,12 @@ class FundamentalIrqlRestoreFunction extends IrqlRestoreFunction {
6160
* _IRQL_restores_-annotated parameter to an OS function that restores
6261
* the IRQL.
6362
*/
64-
class IrqlFlowConfiguration extends DataFlow::Configuration {
65-
IrqlFlowConfiguration() { this = "IrqlFlowConfiguration" }
66-
67-
override predicate isSource(DataFlow::Node source) {
63+
module IrqlFlowConfigurationConfig implements DataFlow::ConfigSig {
64+
predicate isSource(DataFlow::Node source) {
6865
source.asParameter() instanceof IrqlRestoreParameter
6966
}
7067

71-
override predicate isSink(DataFlow::Node sink) {
68+
predicate isSink(DataFlow::Node sink) {
7269
exists(FunctionCall fc, FundamentalIrqlRestoreFunction firf |
7370
fc.getTarget() = firf and
7471
(
@@ -79,21 +76,22 @@ class IrqlFlowConfiguration extends DataFlow::Configuration {
7976
)
8077
}
8178
}
79+
module IrqlFlowConfiguration = DataFlow::Global<IrqlFlowConfigurationConfig>;
8280

83-
from IrqlRestoreFunction irf, IrqlFlowConfiguration ifc
81+
from IrqlRestoreFunction irf
8482
where
8583
// Exclude OS functions
8684
not irf instanceof FundamentalIrqlRestoreFunction and
8785
(
8886
// Account for case where parameter is touched but has no path to restore the IRQL
89-
exists(DataFlow::PathNode source |
90-
source.getNode().asParameter() = irf.getRestoreParameter() and
91-
not ifc.hasFlowPath(source, _)
87+
exists(DataFlow::Node source |
88+
source.asParameter() = irf.getRestoreParameter() and
89+
not IrqlFlowConfiguration::flow(source, _)
9290
)
9391
or
9492
// Account for case where parameter is totally untouched
95-
not exists(DataFlow::PathNode source |
96-
source.getNode().asParameter() = irf.getRestoreParameter()
93+
not exists(DataFlow::Node source |
94+
source.asParameter() = irf.getRestoreParameter()
9795
)
9896
)
9997
select irf,

‎src/drivers/general/queries/experimental/DefaultPoolTagExtended/DefaultPoolTagExtended.ql‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,9 @@
1717
* @scope domainspecific
1818
* @query-version v1
1919
*/
20+
2021
import cpp
21-
import semmle.code.cpp.dataflow.DataFlow
22+
import semmle.code.cpp.dataflow.new.DataFlow
2223

2324
/** A pool allocation function (has a ULONG "Tag" field, a "Flags" field, and a size parameter.) */
2425
class PoolTypeFunction extends Function {
@@ -28,8 +29,8 @@ class PoolTypeFunction extends Function {
2829
p.getName().matches("Tag") and
2930
p.getType().getName().matches("ULONG")
3031
) and
31-
this.getAParameter().getName().matches("Flags")
32-
and this.getAParameter().getType().getName().matches("SIZE_T")
32+
this.getAParameter().getName().matches("Flags") and
33+
this.getAParameter().getType().getName().matches("SIZE_T")
3334
}
3435
}
3536

@@ -47,25 +48,24 @@ class GlobalDefaultPoolTag extends GlobalVariable {
4748
}
4849

4950
/** An interprocedural data-flow analysis looking for flow from bad (default) pool tags. */
50-
class DefaultPoolTagFlow extends DataFlow::Configuration {
51-
DefaultPoolTagFlow() { this = "DefaultPoolTagFlow" }
52-
53-
override predicate isSource(DataFlow::Node source) { source.asExpr() instanceof DefaultPoolTag }
51+
module DefaultPoolTagFlowConfig implements DataFlow::ConfigSig {
52+
predicate isSource(DataFlow::Node source) { source.asExpr() instanceof DefaultPoolTag }
5453

55-
override predicate isSink(DataFlow::Node sink) { sink instanceof DataFlow::ExprNode }
54+
predicate isSink(DataFlow::Node sink) { sink instanceof DataFlow::ExprNode }
5655
}
56+
module DefaultPoolTagFlow = DataFlow::Global<DefaultPoolTagFlowConfig>;
5757

58-
/** An interprocedural data-flow analysis looking for flow from good pool tags. */
59-
class ValidPoolTagFlow extends DataFlow::Configuration {
60-
ValidPoolTagFlow() { this = "ValidPoolTagFlow" }
6158

62-
override predicate isSource(DataFlow::Node source) {
59+
/** An interprocedural data-flow analysis looking for flow from good pool tags. */
60+
module ValidPoolTagFlowConfig implements DataFlow::ConfigSig {
61+
predicate isSource(DataFlow::Node source) {
6362
source.asExpr() instanceof Literal and
6463
not source.asExpr() instanceof DefaultPoolTag
6564
}
6665

67-
override predicate isSink(DataFlow::Node sink) { sink instanceof DataFlow::ExprNode }
66+
predicate isSink(DataFlow::Node sink) { sink instanceof DataFlow::ExprNode }
6867
}
68+
module ValidPoolTagFlow = DataFlow::Global<ValidPoolTagFlowConfig>;
6969

7070
from FunctionCall fc, int i, GlobalDefaultPoolTag gdpt
7171
where
@@ -76,17 +76,17 @@ where
7676
// A bad tag is directly passed in
7777
fc.getArgument(i) instanceof DefaultPoolTag
7878
or
79-
// A global tag variable is being passed in, and no path exists
79+
// A global tag variable is being passed in, and no path exists
8080
// where a good tag has been assigned instead
8181
fc.getArgument(i).(VariableAccess).getTarget() = gdpt and
82-
not exists(ValidPoolTagFlow dataFlow, DataFlow::Node source, DataFlow::Node sink |
82+
not exists(DataFlow::Node source, DataFlow::Node sink |
8383
sink.asExpr() = fc.getArgument(i) and
84-
dataFlow.hasFlow(source, sink)
84+
ValidPoolTagFlow::flow(source, sink)
8585
)
8686
or
8787
// A local variable with a bad tag is being passed in
88-
exists(DefaultPoolTagFlow dataFlow, DataFlow::Node source, DataFlow::Node sink |
88+
exists(DataFlow::Node source, DataFlow::Node sink |
8989
sink.asExpr() = fc.getArgument(i) and
90-
dataFlow.hasFlow(source, sink)
90+
DefaultPoolTagFlow::flow(source, sink)
9191
)
9292
select fc.getArgument(i), "Default pool tag used in function call"

‎src/drivers/kmdf/queries/experimental/DeviceInitApi/DeviceInitApi.ql‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,7 @@
1313
*/
1414

1515
import drivers.kmdf.libraries.KmdfDrivers
16-
import semmle.code.cpp.dataflow.DataFlow
17-
import DataFlow::PathGraph
16+
import semmle.code.cpp.dataflow.new.DataFlow
1817

1918
/** A function that initializes or changes a WDFDEVICE_INIT struct, and which must not be called after WDFDeviceCreate. */
2019
class WdfInitializationApi extends Function {
@@ -73,24 +72,23 @@ predicate isChildExpr(Expr e, FunctionCall func) {
7372
* A data-flow model to determine if a use of a WDFDEVICE_INIT struct is
7473
* used in an initialization function after WdfDeviceCreate is called.
7574
*/
76-
class InitAPIDataFlow extends DataFlow::Configuration {
77-
InitAPIDataFlow() { this = "KMDFDeviceInitApiFlow" }
75+
module InitAPIDataFlowConfig implements DataFlow::ConfigSig {
7876

79-
override predicate isSource(DataFlow::Node source) {
77+
predicate isSource(DataFlow::Node source) {
8078
exists(FunctionCall fc |
8179
fc.getTarget().getName().matches("WdfDeviceCreate") and
8280
fc.getArgument(0).getAChild*() = source.asExpr()
8381
)
8482
}
8583

86-
override predicate isSink(DataFlow::Node sink) {
84+
predicate isSink(DataFlow::Node sink) {
8785
exists(FunctionCall fc |
8886
fc.getTarget() instanceof WdfInitializationApi and
8987
fc.getArgument(0).getAChild*() = sink.asExpr()
9088
)
9189
}
9290

93-
override predicate isAdditionalFlowStep(DataFlow::Node source, DataFlow::Node sink) {
91+
predicate isAdditionalFlowStep(DataFlow::Node source, DataFlow::Node sink) {
9492
exists(FunctionCall fc |
9593
fc.getTarget().getName().matches("WdfDeviceCreate") and
9694
fc.getTarget() = sink.getFunction() and
@@ -99,13 +97,16 @@ class InitAPIDataFlow extends DataFlow::Configuration {
9997
}
10098
}
10199

102-
from InitAPIDataFlow iadf, DataFlow::PathNode e1, DataFlow::PathNode e2
100+
module InitAPIDataFlow = DataFlow::Global<InitAPIDataFlowConfig>;
101+
import InitAPIDataFlow::PathGraph
102+
103+
from InitAPIDataFlow::PathNode e1, InitAPIDataFlow::PathNode e2
103104
where
104105
exists(FunctionCall driverCreateCall, WdfInitiailzationApiCall apiCall |
105106
driverCreateCall.getAChild*() = e1.getNode().asExpr() and
106107
isChildExpr(e2.getNode().asExpr(), apiCall) and
107108
driverCreateCall.getASuccessor*() = apiCall
108109
) and
109-
iadf.hasFlowPath(e1, e2)
110+
InitAPIDataFlow::flowPath(e1, e2)
110111
select e1.getNode(), e1, e2,
111112
"A WDF device object initialization method was called after WdfDeviceCreate was called on the same WDFDEVICE_INIT struct. This can lead to system instability."

0 commit comments

Comments
 (0)