Skip to content

Add usermode_accessors.h sample driver (AB#61473417)#1357

Closed
limitedge wants to merge 61 commits intomicrosoft:developfrom
limitedge:fix/AB61473417-usermode-accessors-sample
Closed

Add usermode_accessors.h sample driver (AB#61473417)#1357
limitedge wants to merge 61 commits intomicrosoft:developfrom
limitedge:fix/AB61473417-usermode-accessors-sample

Conversation

@limitedge
Copy link

Summary

Add a new KMDF sample driver demonstrating safe user-mode memory access using the usermode_accessors.h DDI family.

New Sample

Path: general/usermode-accessors-sample/

DDIs Covered

This sample exercises 30+ DDI functions from usermode_accessors.h, including:

Category DDIs
Copy CopyFromUser, CopyToUser, CopyFromMode, CopyToMode
Read ReadUCharFromUser, ReadUShortFromUser, ReadULongFromUser, ReadULong64FromUser, ReadBooleanFromUser
Write WriteUCharToUser, WriteUShortToUser, WriteULongToUser, WriteULong64ToUser, WriteBooleanToUserRelease
Mode ReadULongFromMode, WriteULongToMode
Struct ReadStructFromUser, WriteStructToUser
Fill FillUserMemory
Interlocked InterlockedAndToUser, InterlockedOrToUser, InterlockedCompareExchangeToUser
String StringLengthFromUser, WideStringLengthFromUser
Exception UmaExceptionFilter

ADO Work Item

5an7y and others added 30 commits June 27, 2025 12:59
PR to test changes from original branch. No harm done since this is done to my users branch
5an7y-Microsoft and others added 25 commits October 3, 2025 12:02
New issues template based on sample.
…seIssues

adding workflow to bulk cleanup stale issues older than 1 year
Increase operations-per-run to 400 and the stale threshold
use PAT_TOKEN and add dry-run for testing purpose.
…Workflow

disable schedule and deleted the closing issue part
removed the space after newline which seems to be a bug in c++ 23
…pdateScript

update Script to be compatible with vs2026
Added 'if: false' to the job to prevent it from running while preserving the code.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ble-tag-owners

Disable tag-codeowner-on-issue workflow
…test-infra-changes

Making INF verifier and option to the build all samples PS script
… direct interpolation

Co-authored-by: 5an7y-Microsoft <219205893+5an7y-Microsoft@users.noreply.github.com>
…ity-in-workflow

Fix RCE in tag-codeowner-on-issue workflow via environment variables
Fix RCE vulnerability in workflow using environment variables
New KMDF sample demonstrating safe user-mode memory access
using the usermode_accessors.h DDI family.

DDIs covered: CopyFromUser, CopyToUser, ReadULongFromUser,
WriteULongToUser, FillUserMemory, InterlockedAndToUser,
StringLengthFromUser, ReadStructFromUser, WriteStructToUser,
UmaExceptionFilter, and 20+ additional typed accessors.

Fixes DDI coverage gaps for usermode_accessors.h header.

AB#61473417
@limitedge limitedge requested review from a team as code owners March 18, 2026 17:33
DECLARE_CONST_UNICODE_STRING(circuitUri, EXT_CAPTURE_CIRCUIT_URI);

#pragma prefast(suppress:__WARNING_ALIASED_MEMORY_LEAK, "memory is freed by scope_exit")
PSDCAXU_ACX_CIRCUIT_CONFIG exCircuitConfig = (PSDCAXU_ACX_CIRCUIT_CONFIG)ExAllocatePool2(

Check warning

Code scanning / CodeQL

Possible information leakage from uninitialized padding bytes. Warning

Memory allocation of
_SDCAXU_ACX_CIRCUIT_CONFIG
includes uninitialized padding bytes.
DECLARE_CONST_UNICODE_STRING(circuitUri, EXT_RENDER_CIRCUIT_URI);

#pragma prefast(suppress:__WARNING_ALIASED_MEMORY_LEAK, "memory is freed by scope_exit")
PSDCAXU_ACX_CIRCUIT_CONFIG exCircuitConfig = (PSDCAXU_ACX_CIRCUIT_CONFIG)ExAllocatePool2(

Check warning

Code scanning / CodeQL

Possible information leakage from uninitialized padding bytes. Warning

Memory allocation of
_SDCAXU_ACX_CIRCUIT_CONFIG
includes uninitialized padding bytes.
RETURN_NTSTATUS_IF_TRUE(pinConnection != nullptr, status);

pinConnectionSize = (ULONG)info;
pinConnection = (PKSPIN_PHYSICALCONNECTION)ExAllocatePool2(POOL_FLAG_NON_PAGED, pinConnectionSize, DRIVER_TAG);

Check warning

Code scanning / CodeQL

Possible information leakage from uninitialized padding bytes. Warning

Memory allocation of
KSPIN_PHYSICALCONNECTION
includes uninitialized padding bytes.
m_PartialFrameBytes = m_FrameSize - (DWORD)length;

Done:
KeRestoreFloatingPointState(&saveData);

Check warning

Code scanning / CodeQL

Irql Float State Mismatch Warning

The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (1).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (2).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (3).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (4).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (5).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (6).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (7).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (8).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (9).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (10).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (11).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (12).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (13).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (14).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (15).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (0).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (2).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (3).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (4).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (5).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (6).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (7).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (8).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (9).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (10).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (11).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (12).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (13).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (14).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (15).
The irql level where the floating-point state was saved (2) does not match the irql level for the restore operation (0).
The irql level where the floating-point state was saved (2) does not match the irql level for the restore operation (1).
The irql level where the floating-point state was saved (2) does not match the irql level for the restore operation (3).
The irql level where the floating-point state was saved (2) does not match the irql level f
m_PartialFrameBytes = m_FrameSize - (DWORD)length;

Done:
KeRestoreFloatingPointState(&saveData);

Check warning

Code scanning / CodeQL

Irql Float State Mismatch Warning

The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (1).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (2).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (3).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (4).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (5).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (6).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (7).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (8).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (9).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (10).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (11).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (12).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (13).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (14).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (15).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (0).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (2).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (3).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (4).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (5).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (6).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (7).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (8).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (9).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (10).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (11).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (12).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (13).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (14).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (15).
The irql level where the floating-point state was saved (2) does not match the irql level for the restore operation (0).
The irql level where the floating-point state was saved (2) does not match the irql level for the restore operation (1).
The irql level where the floating-point state was saved (2) does not match the irql level for the restore operation (3).
The irql level where the floating-point state was saved (2) does not match the irql level f
//
// Restore floating state.
//
KeRestoreFloatingPointState(&saveData);

Check warning

Code scanning / CodeQL

Irql Float State Mismatch Warning

The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (1).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (2).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (3).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (4).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (5).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (6).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (7).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (8).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (9).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (10).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (11).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (12).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (13).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (14).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (15).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (0).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (2).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (3).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (4).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (5).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (6).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (7).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (8).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (9).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (10).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (11).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (12).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (13).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (14).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (15).
The irql level where the floating-point state was saved (2) does not match the irql level for the restore operation (0).
The irql level where the floating-point state was saved (2) does not match the irql level for the restore operation (1).
The irql level where the floating-point state was saved (2) does not match the irql level for the restore operation (3).
The irql level where the floating-point state was saved (2) does not match the irql level f
//
// Restore floating state.
//
KeRestoreFloatingPointState(&saveData);

Check warning

Code scanning / CodeQL

Irql Float State Mismatch Warning

The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (1).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (2).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (3).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (4).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (5).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (6).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (7).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (8).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (9).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (10).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (11).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (12).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (13).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (14).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (15).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (0).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (2).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (3).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (4).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (5).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (6).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (7).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (8).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (9).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (10).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (11).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (12).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (13).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (14).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (15).
The irql level where the floating-point state was saved (2) does not match the irql level for the restore operation (0).
The irql level where the floating-point state was saved (2) does not match the irql level for the restore operation (1).
The irql level where the floating-point state was saved (2) does not match the irql level for the restore operation (3).
The irql level where the floating-point state was saved (2) does not match the irql level f
ntStatus = ReadHeaderAndFillBuffer();

Done:
(void)KeRestoreFloatingPointState(&saveData);

Check warning

Code scanning / CodeQL

Irql Float State Mismatch Warning

The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (1).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (2).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (3).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (4).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (5).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (6).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (7).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (8).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (9).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (10).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (11).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (12).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (13).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (14).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (15).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (0).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (2).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (3).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (4).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (5).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (6).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (7).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (8).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (9).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (10).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (11).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (12).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (13).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (14).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (15).
The irql level where the floating-point state was saved (2) does not match the irql level for the restore operation (0).
The irql level where the floating-point state was saved (2) does not match the irql level for the restore operation (1).
The irql level where the floating-point state was saved (2) does not match the irql level for the restore operation (3).
The irql level where the floating-point state was saved (2) does not match the irql level f
ntStatus = ReadHeaderAndFillBuffer();

Done:
(void)KeRestoreFloatingPointState(&saveData);

Check warning

Code scanning / CodeQL

Irql Float State Mismatch Warning

The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (1).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (2).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (3).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (4).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (5).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (6).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (7).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (8).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (9).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (10).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (11).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (12).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (13).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (14).
The irql level where the floating-point state was saved (0) does not match the irql level for the restore operation (15).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (0).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (2).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (3).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (4).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (5).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (6).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (7).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (8).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (9).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (10).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (11).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (12).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (13).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (14).
The irql level where the floating-point state was saved (1) does not match the irql level for the restore operation (15).
The irql level where the floating-point state was saved (2) does not match the irql level for the restore operation (0).
The irql level where the floating-point state was saved (2) does not match the irql level for the restore operation (1).
The irql level where the floating-point state was saved (2) does not match the irql level for the restore operation (3).
The irql level where the floating-point state was saved (2) does not match the irql level f
@limitedge limitedge closed this Mar 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants