Caleb/krn 1117 stackdepot port codeql

.github/codeql/stackdepot/StackDepot.qll

@@ -0,0 +1,69 @@
+import cpp
+
+predicate isStackDepotFile(File f) {
+  f.getRelativePath() = "lib/stackdepot.c"
+}
+
+predicate isStackDepotFunction(Function f) {
+  isStackDepotFile(f.getFile())
+}
+
+predicate isTrieWriterOrchestrator(Function f) {
+  isStackDepotFunction(f) and
+  f.getName() = "stack_depot_trie_insert_locked"
+}
+
+predicate trustedStructuralHelperName(string name) {
+  name = "trie_build_append_chain" or
+  name = "trie_build_split" or
+  name = "trie_child_array_insert_at" or
+  name = "trie_child_array_replace_at" or
+  name = "trie_node_init_slice" or
+  name = "trie_publish_tail_append" or
+  name = "trie_reparent_children"
+}
+
+predicate isTrustedStructuralHelper(Function f) {
+  isStackDepotFunction(f) and
+  trustedStructuralHelperName(f.getName())
+}
+
+predicate isSidePublishFunction(Function f) {
+  isStackDepotFunction(f) and
+  (f.getName() = "trie_side_table_publish_new_leaf" or
+   f.getName() = "trie_side_table_publish_split_leaves")
+}
+
+predicate isBoundaryFunction(Function f) {
+  isStackDepotFunction(f) and
+  (
+    f.getName().matches("%init%") or
+    f.getName().matches("%prealloc%") or
+    f.getName().matches("%lookup%") or
+    f.getName().matches("%fetch%") or
+    f.getName().matches("%save%") or
+    f.getName().matches("%put%") or
+    f.getName().matches("%print%") or
+    f.getName().matches("%snprint%") or
+    f.getName().matches("%handle%")
+  )
+}
+
+bindingset[name]
+predicate isForbiddenTrieAbstractionName(string name) {
+  name.matches("%lookup_status%") or
+  (name.matches("%trie_lookup%") and name.matches("%status%")) or
+  name.matches("%alloc_txn%") or
+  name.matches("%alloc_request%") or
+  name.matches("%pool_mark%") or
+  name.matches("%rollback%") or
+  name.matches("%insert_plan%") or
+  name.matches("%child_array_slot%") or
+  name.matches("%node_slot%") or
+  name.matches("%leaf_update%")
+}
+
+predicate returnsEinvalExpr(Expr e) {
+  // Linux UAPI errno value for EINVAL.
+  e.getValue().toInt() = -22
+}

.github/codeql/stackdepot/StackDepotForbiddenTrieAbstractions.ql

@@ -0,0 +1,17 @@
+/**
+ * @name Deleted stackdepot trie abstraction reintroduced
+ * @description Flags names matching deleted lookup/status/transaction/slot/rollback machinery.
+ * @kind problem
+ * @problem.severity recommendation
+ * @precision high
+ * @id stackdepot/forbidden-trie-abstraction
+ */
+
+import cpp
+import StackDepot
+
+from Declaration d
+where
+  isStackDepotFile(d.getFile()) and
+  isForbiddenTrieAbstractionName(d.getName())
+select d, "Stackdepot trie declaration '$@' looks like deleted status, transaction, plan, slot, update, or rollback machinery.", d, d.getName()

.github/codeql/stackdepot/StackDepotGenericStateCarrier.ql

@@ -0,0 +1,45 @@
+/**
+ * @name Stackdepot trie generic state carrier
+ * @description Flags one-field trie wrappers and pointer/size carrier structs that may lack a real invariant.
+ * @kind problem
+ * @problem.severity recommendation
+ * @precision medium
+ * @id stackdepot/generic-state-carrier
+ */
+
+import cpp
+import StackDepot
+
+predicate isPointerSizeCarrier(Struct s) {
+  exists(Field ptr, Field sz |
+    ptr = s.getAField() and
+    sz = s.getAField() and
+    ptr != sz and
+    ptr.getType().toString().matches("%*%") and
+    (sz.getName().matches("%size%") or
+     sz.getName().matches("%bytes%") or
+     sz.getName().matches("%capacity%"))
+  )
+}
+
+predicate isKnownTrieStateStruct(Struct s) {
+  s.getName() = "stack_depot_trie_node" or
+  s.getName() = "stack_depot_trie_child_array" or
+  s.getName() = "stack_depot_trie_free_node" or
+  s.getName() = "stack_depot_trie_free_object" or
+  s.getName() = "stack_depot_trie_side_dir" or
+  s.getName() = "stack_depot_trie_side_root" or
+  s.getName() = "stack_depot_trie_side_prealloc" or
+  s.getName() = "stack_depot_trie_alloc_workspace"
+}
+
+from Struct s
+where
+  isStackDepotFile(s.getFile()) and
+  s.getName().matches("%trie%") and
+  not isKnownTrieStateStruct(s) and
+  (
+    count(Field f | f = s.getAField()) = 1 or
+    isPointerSizeCarrier(s)
+  )
+select s, "Trie struct '$@' looks like a one-field wrapper or generic pointer/size carrier; verify it carries a real invariant.", s, s.getName()

.github/codeql/stackdepot/StackDepotKunitOnlyProductionHook.ql

@@ -0,0 +1,35 @@
+/**
+ * @name Stackdepot production helper used only by KUnit
+ * @description Flags stackdepot production helpers that appear to exist only for KUnit tests.
+ * @kind problem
+ * @problem.severity recommendation
+ * @precision medium
+ * @id stackdepot/kunit-only-production-hook
+ */
+
+import cpp
+import StackDepot
+
+predicate calledFromStackdepotKunit(Function f) {
+  exists(FunctionCall call |
+    call.getTarget() = f and
+    call.getFile().getRelativePath() = "lib/tests/stackdepot_kunit.c"
+  )
+}
+
+predicate calledFromNonKunit(Function f) {
+  exists(FunctionCall call |
+    call.getTarget() = f and
+    call.getFile().getRelativePath() != "lib/tests/stackdepot_kunit.c"
+  )
+}
+
+from Function f
+where
+  isStackDepotFunction(f) and
+  not f.getName().matches("%kunit%") and
+  not f.getName().matches("stack_depot_%") and
+  not f.getName().matches("__stack_depot_%") and
+  calledFromStackdepotKunit(f) and
+  not calledFromNonKunit(f)
+select f, "Production stackdepot helper '$@' appears KUnit-only; avoid production helper surface just for tests.", f, f.getName()

.github/codeql/stackdepot/StackDepotPageOwnerCountableSaves.ql

@@ -0,0 +1,20 @@
+/**
+ * @name page_owner stackdepot save must stay countable
+ * @description Flags page_owner stackdepot saves that are not explicitly countable/hash-backed.
+ * @kind problem
+ * @problem.severity recommendation
+ * @precision high
+ * @id stackdepot/page-owner-countable-save
+ */
+
+import cpp
+
+predicate isPageOwnerFile(File f) {
+  f.getRelativePath() = "mm/page_owner.c"
+}
+
+from FunctionCall call
+where
+  isPageOwnerFile(call.getFile()) and
+  call.getTarget().hasName("stack_depot_save")
+select call, "page_owner direct stack_depot_save() can route into trie storage; use stack_depot_save_flags() with STACK_DEPOT_FLAG_COUNTABLE."

.github/codeql/stackdepot/StackDepotTrieNodeSizeRevalidation.ql

@@ -0,0 +1,23 @@
+/**
+ * @name Stackdepot trie node-size helper performs defensive checks
+ * @description Flags defensive checks inside __stack_depot_trie_node_size(); constructed trie runs should make node size a direct calculation.
+ * @kind problem
+ * @problem.severity recommendation
+ * @precision medium
+ * @id stackdepot/trie-node-size-defensive-check
+ * @previous-id stackdepot/trie-node-size-revalidation
+ */
+
+import cpp
+import StackDepot
+
+predicate isNodeSizeHelper(Function f) {
+  isStackDepotFile(f.getFile()) and
+  f.getName() = "__stack_depot_trie_node_size"
+}
+
+from Function f, IfStmt ifs
+where
+  isNodeSizeHelper(f) and
+  ifs.getEnclosingFunction() = f
+select ifs, "__stack_depot_trie_node_size() contains conditional validation; constructed frame-run metadata should make node size a direct calculation."

.github/codeql/stackdepot/StackDepotTrieNullModeSelector.ql

@@ -0,0 +1,27 @@
+/**
+ * @name Stackdepot trie helper uses NULL as operation mode
+ * @description Flags trusted structural helpers branching on pointer parameters, a common hidden operation selector.
+ * @kind problem
+ * @problem.severity recommendation
+ * @precision medium
+ * @id stackdepot/trie-null-mode-selector
+ */
+
+import cpp
+import StackDepot
+
+predicate conditionMentionsPointerParam(IfStmt ifs, Parameter p) {
+  p.getType().toString().matches("%*%") and
+  (
+    ifs.getCondition().toString().matches("%" + p.getName() + "%NULL%") or
+    ifs.getCondition().toString().matches("%!" + p.getName() + "%")
+  )
+}
+
+from Function f, Parameter p, IfStmt ifs
+where
+  isTrustedStructuralHelper(f) and
+  p.getFunction() = f and
+  ifs.getEnclosingFunction() = f and
+  conditionMentionsPointerParam(ifs, p)
+select ifs, "Trusted trie helper $@ branches on pointer parameter '$@'; verify NULL is not an operation selector.", f, f.getName(), p, p.getName()

.github/codeql/stackdepot/StackDepotTrieOncePrimitive.ql

@@ -0,0 +1,21 @@
+/**
+ * @name Stackdepot trie READ_ONCE or WRITE_ONCE use
+ * @description Flags trie-specific READ_ONCE/WRITE_ONCE uses so reviewers verify a lockless reader or publication pairing.
+ * @kind problem
+ * @problem.severity recommendation
+ * @precision high
+ * @id stackdepot/trie-once-primitive
+ */
+
+import cpp
+import StackDepot
+
+from MacroInvocation m
+where
+  isStackDepotFile(m.getFile()) and
+  (m.getMacroName() = "READ_ONCE" or m.getMacroName() = "WRITE_ONCE") and
+  (
+    m.toString().matches("%nr_children%") or
+    m.toString().matches("%trie%")
+  )
+select m, "Trie-specific $@ use; verify a documented lockless reader or publication pairing justifies it.", m, m.getMacroName()

.github/codeql/stackdepot/StackDepotTriePublishThenFailure.ql

@@ -0,0 +1,43 @@
+/**
+ * @name Stackdepot trie normal failure after publication
+ * @description Flags normal error returns after side-table or structural publication starts in the writer path.
+ * @kind problem
+ * @problem.severity recommendation
+ * @precision medium
+ * @id stackdepot/trie-publish-then-failure
+ */
+
+import cpp
+import StackDepot
+
+predicate publishCall(FunctionCall call) {
+  call.getTarget().getName().matches("trie_side_table_publish_%") or
+  call.getTarget().getName().matches("trie_publish_%")
+}
+
+predicate normalFailureReturn(ReturnStmt ret) {
+  ret.hasExpr() and
+  (
+    ret.getExpr().toString().matches("-%") or
+    ret.getExpr().toString() = "ret"
+  )
+}
+
+predicate retFailureGuard(IfStmt guard) {
+  guard.getCondition().toString().matches("%ret%")
+}
+
+from Function f, FunctionCall pub, IfStmt guard, ReturnStmt ret
+where
+  isTrieWriterOrchestrator(f) and
+  pub.getEnclosingFunction() = f and
+  guard.getEnclosingFunction() = f and
+  ret.getEnclosingFunction() = f and
+  publishCall(pub) and
+  retFailureGuard(guard) and
+  normalFailureReturn(ret) and
+  guard.getLocation().getStartLine() > pub.getLocation().getStartLine() and
+  guard.getLocation().getStartLine() <= pub.getLocation().getStartLine() + 2 and
+  ret.getLocation().getStartLine() >= guard.getLocation().getStartLine() and
+  ret.getLocation().getStartLine() <= guard.getLocation().getEndLine()
+select ret, "Normal failure guard immediately after trie side-table or structural publication; expected failures should happen before publication begins."

.github/codeql/stackdepot/StackDepotTrieSidePublishInTrustedHelper.ql

@@ -0,0 +1,23 @@
+/**
+ * @name Trusted stackdepot trie helper publishes side-table state directly
+ * @description Flags direct side-table publication calls in trusted trie insertion helpers.
+ * @kind problem
+ * @problem.severity recommendation
+ * @precision high
+ * @id stackdepot/trie-side-publish-in-trusted-helper
+ */
+
+import cpp
+import StackDepot
+
+predicate sidePublishFunctionName(string name) {
+  name = "trie_side_table_publish_new_leaf" or
+  name = "trie_side_table_publish_split_leaves"
+}
+
+from FunctionCall call, Function f
+where
+  f = call.getEnclosingFunction() and
+  isTrustedStructuralHelper(f) and
+  sidePublishFunctionName(call.getTarget().getName())
+select call, "Trusted trie insertion helper $@ publishes side-table state directly; verify this belongs in the planned publish operation and has clear failure handling.", f, f.getName()

.github/codeql/stackdepot/StackDepotTrieStateRediscovery.ql

@@ -0,0 +1,24 @@
+/**
+ * @name Trusted stackdepot trie helper rediscovers insertion state
+ * @description Flags calls that rediscover planner/writer state inside trusted trie insertion helpers.
+ * @kind problem
+ * @problem.severity recommendation
+ * @precision high
+ * @id stackdepot/trie-state-rediscovery
+ */
+
+import cpp
+import StackDepot
+
+predicate rediscoveryFunctionName(string name) {
+  name = "trie_child_array_find_slot" or
+  name = "stack_depot_trie_lookup"
+}
+
+from FunctionCall call, Function f, Function target
+where
+  f = call.getEnclosingFunction() and
+  isTrustedStructuralHelper(f) and
+  target = call.getTarget() and
+  rediscoveryFunctionName(target.getName())
+select call, "Trusted trie insertion helper $@ calls $@ here; verify this state was not already established by planning/writer serialization.", f, f.getName(), target, target.getName()

.github/codeql/stackdepot/StackDepotTrustedHelperReturnEinval.ql

@@ -0,0 +1,24 @@
+/**
+ * @name Trusted stackdepot trie helper returns direct -EINVAL
+ * @description Flags direct -EINVAL returns in trusted trie structural helpers.
+ * @kind problem
+ * @problem.severity recommendation
+ * @precision high
+ * @id stackdepot/trusted-helper-return-einval
+ */
+
+import cpp
+import StackDepot
+
+predicate returnsEinval(ReturnStmt ret) {
+  ret.hasExpr() and
+  // Linux UAPI errno value for EINVAL.
+  ret.getExpr().getValue().toInt() = -22
+}
+
+from ReturnStmt ret, Function f
+where
+  f = ret.getEnclosingFunction() and
+  isTrustedStructuralHelper(f) and
+  returnsEinval(ret)
+select ret, "Trusted trie structural helper $@ returns direct -EINVAL here; verify this is not rediscovering a writer-side invariant.", f, f.getName()

.github/codeql/stackdepot/qlpack.yml

@@ -0,0 +1,6 @@
+name: stackdepot/codeql
+version: 0.0.1
+dependencies:
+  codeql/cpp-all: "*"
+extractor: cpp
+warnOnImplicitThis: true