KernelGuardedMutexes.qll

import cpp
import AcquireRelease

class GuardedMutexAcquire extends AcquireOperation {
    GuardedMutexAcquire() {
        exists(Function target | 
            target = this.getTarget() |
            target.hasGlobalName("KeAcquireGuardedMutex")
            or target.hasGlobalName("KeAcquireGuardedMutexUnsafe")
        )
    }

    override Variable getAcquired() {
        result.getAnAccess() = this.getArgument(0)
    }

    predicate isMatchingReleaseFunction(Function target) {
        (
            this.getTarget().hasGlobalName("KeAcquireGuardedMutex")
            and target.hasGlobalName("KeReleaseGuardedMutex")
        )
        or
        (
            this.getTarget().hasGlobalName("KeAcquireGuardedMutexUnsafe")
            and target.hasGlobalName("KeReleaseGuardedMutexUnsafe")
        )
    }

    override ReleaseOperation getMatchingRelease() {
        result.(GuardedMutexRelease).getReleased() = this.getAcquired()
    }

    override string say() {
        result = "guarded mutex acquisition of " + this.getAcquired().getName()
    }
}

class GuardedMutexRelease extends ReleaseOperation {
    GuardedMutexRelease() {
        exists(Function target |
            target = this.getTarget() |
            target.hasGlobalName("KeReleaseGuardedMutex")
            or target.hasGlobalName("KeReleaseGuardedMutexUnsafe")
        )
    }

    Variable getReleased() {
        result.getAnAccess() = this.getArgument(0)
    }

    override AcquireOperation getMatchingAcquire() {
        this = result.(GuardedMutexAcquire).getMatchingRelease()
    }

    override string say() {
        result = "guarded mutex release of " + this.getReleased().getName()
    }
}