microsoft / microsoft/Windows-Driver-Developer-Supplemental-Tools
IRQL queries should be disabled for UMDF drivers
Nobody has claimed this yet.
- Dominant language
- CodeQL
- Stars
- 85
- Forks
- 38
- PR merge metrics
- No merged PRs in 30d
Description
We have a customer who uses a shared library that compiles for both KMDF and UMDF drivers. The library has IRQL annotations, so when running our IRQL queries on a UMDF driver that depends on this library, the queries fail as they cannot find the proper IRQL values from wdm.h. This leads to false positives in the IrqlAnnotationIssue query and could cause false positives in the other IRQL queries.
In general (perhaps to make a long-term enhancement) we should improve the ability of our queries to "exit fast" when they are run on a driver scenario they are not applicable for.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the IrqlAnnotationIssue query and the other IRQL queries, then trace how they identify driver scenarios and obtain IRQL values from wdm.h. The work is done when IRQL queries exit without reporting false positives for UMDF drivers while remaining applicable to KMDF drivers.
Written by the indexing model from the issue text.
Assessment
- Domain
- devtools, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100