False positive

[Akshay865]

I am writing a query which detect the Sal IRQL annotation on Driver code. So there is file public.h where
DRIVER_INITIALIZE DriverEntry; is written

There is a Driver.cpp

Where

IRQL_requires(passive_level)
NTSTATUS
DriverEntry()

I wrote a query which is detecting the functions which don’t have SAL Irql . Here I have annotated in the DriverEntry function. When I run the query it gives results from public.h location. DriverEntry is not annotated with SAL IRQl.

Query looks like

Class SALirql extends SALAnnotations{

SALIrql()
{
this.getMacroName() in [“IRQL_requires”,…]

}
}

from Function f1, Function F2

Where
f1.getADeclarationEntry()=f2.getADeclarationEntry() and
not exists ( SALIrql s | s.getDeclarationEntry()= f1.getDeclarationEntry()

Select f1, f1.getName() + “ function does not have the SAL IRQL “

[rvermeulen]

Hi @Akshay865,

Thanks for your question.

It looks like you are trying to find function declarations missing the IRQL_requires macro.
To help with that I need some further clarification.

• Does the IRQL_requires annotation need to be on all declarations, or just the definition?
• It is sufficient if any declaration has the annotation, must all declarations have the annotation, or only the definition.
• Why are you looking at two functions with the same declaration entry?

A declaration can have many declaration entries (the relation between declaration and entries is documented here) of which one is the definition.

[Akshay865]

Hi @rvermeulen,
Thanks for your reply.

I wrote this query to find the functions (Either of its declaration or definition) should have the IRQL annotation.
If Both the declaration and definition don't have it then it should be flagged.

Here in my code, Public.h has DRIVER_INITIALIZE DriverEntry; Codeql is flagging this line.

Where in Driver.cpp the Driver Function against it is already annotated with SAL IRQL so, its function should not have been flagged. It is not happening for other functions like which are declared in public.h or other places. Its for These Functions like DriverEntry which is declared in Public.h