Code Analysis for Drivers Warnings
This section lists and describes the warnings that the Code Analysis for Drivers reports when it detects a possible error in driver code. Note that some warnings are intended for kernel-mode code and can be ignored when analyzing user-mode drivers.
Important
Code Analysis for drivers is available in the Windows 24H2 WDK and EWDK, but be advised that it is set to be retired at a future date.
Going forward, CodeQL will be the primary static analysis tool for drivers. CodeQL provides a powerful query language that treats code as a database to be queried, making it simple to write queries for specific behaviors, patterns, and more.
For more information about using CodeQL, see CodeQL and the Static Tools Logo Test.
Code Analysis for Drivers reports the following types of warnings:
General Warnings (6000-6999): Potential errors in C and C++ syntax and general coding practice. For a description of these warnings, see Code Analysis for C/C++ Warnings.
Windows Specific Warnings (28600-28799): These warnings are specific to certain patterns of use in Windows, but are not specific to drivers.
Driver-Specific Warnings (28100-28199): Errors in a driver's interaction with the application, with other drivers, and with the operating system.
Annotation Errors (28200-28299 and 36000-36999): These warnings indicate that an annotation has been incorrectly coded or used in an improper context. In most cases, the presence of such a warning indicates that the annotation is not having the desired (or any) effect.
Memory Allocation Warnings (30029-30035): These are memory allocation warnings.
In this section
| Topic | Description |
|---|---|
warning C28101: The Drivers module has inferred that the current function is not the correct type of function |
|
warning C28110: Drivers must protect floating-point hardware state. See use of float |
|
warning C28111: The IRQL where the floating-point state was saved does not match the current IRQL (for this restore operation). |
|
warning: C28114: Copying a whole IRP stack entry leaves certain fields initialized that should be cleared or updated. |
|
warning C28120: The function is not permitted to be called at the current IRQ level. The current level is too low. |
|
warning C28121: The function is not permitted to be called at the current IRQ level. The current level is too high. |
|
warning C28122: The function is not permitted to be called at a low IRQ level. Prior function calls are inconsistent with this constraint. |
|
warning C28123: The function is not permitted to be called at a high IRQ level. Prior function calls are inconsistent with this constraint. |
|
warning C28124: The call to causes the IRQ Level to be set below the minimum acceptable for the function being analyzed. |
|
warning C28126: The AccessMode parameter to ObReferenceObject* should be IRP->RequestorMode |
|
warning C28127: The function being used as a routine does not exactly match the type expected. |
|
warning C28128: An access to a field has been made directly. It should be made by a routine. |
|
warning C28129: An assignment has been made to an operand, which should only be modified using bit sets and clears |
|
warning C28131: The DriverEntry routine should save a copy of the argument, not the pointer, because the I/O Manager frees the buffer |
|
warning C28132: Taking the size of pointer |
|
warning C28133: IoInitializeTimer is best called from AddDevice |
|
warning C28134: The type of a pool tag should be integral, not a string or string pointer |
|
warning C28135: If the first argument to KeWaitForSingleObject is a local variable, the Mode parameter must be KernelMode |
|
warning C28139: The argument should exactly match the type |
|
warning C28141: The argument causes the IRQ Level to be set below the current IRQL, and this function cannot be used for that purpose |
|
warning C28143: A dispatch routine that calls IoMarkIrpPending must also return STATUS_PENDING |
|
warning C28144: Within a cancel routine, at the point of exit, the IRQL in Irp->CancelIrql should be the current IRQL. |
|
warning C28145: The opaque MDL structure should not be modified by a driver |
|
warning C28146: Kernel Mode drivers should use ntstrsafe.h, not strsafe.h. Found in source file |
|
warning C28147: The use of a default pool tag (' kdD' or ' mdW') for calls to this function defeats the purpose of pool tagging |
|
warning C28150: The function causes the IRQ Level to be set above the maximum acceptable for the function being analyzed |
|
warning C28151: The value is not a legal value for an IRQL |
|
warning C28152: The return from an AddDevice-like function unexpectedly DO_DEVICE_INITIALIZING |
|
warning C28153: The value for an IRQL from annotation could not be evaluated in this context. |
|
warning C28156: The actual IRQL is inconsistent with the required IRQL |
|
warning C28157: The IRQL was never restored |
|
warning C28158: No IRQL was saved |
|
warning C28161: Exiting without acquiring the right to use floating hardware |
|
warning C28162: Exiting while holding the right to use floating-point hardware |
|
warning C28165: The function pointer of class does not match the function class |
|
warning C28166: The function does not restore the IRQL to the value that was current at function entry and is required to do so. |
|
warning C28167: The function changes the IRQL and does not restore the IRQL before it exits. It should be annotated to reflect the change or the IRQL should be restored. |
|
warning C28168: The dispatch function does not have a Dispatch_type annotation matching this dispatch table entry |
|
warning C28169: The dispatch function does not have any Dispatch_type annotations |
|
warning C28170: The function has been declared to be in a paged segment, but neither PAGED_CODE nor PAGED_CODE_LOCKED was found |
|
warning C28171: The function has more than one instance of PAGED_CODE or PAGED_CODE_LOCKED |
|
warning C28172: The function has PAGED_CODE or PAGED_CODE_LOCKED but is not declared to be in a paged segment |
|
warning C28173: The current function appears to incorrectly adapt to physical memory above 4 GB |
|
warning C28175: The member of struct should not be accessed by a driver |
|
warning C28176: The member of struct should not be modified by a driver |
|
warning C28177: Function is annotated with more than one function class. All but one will be ignored. |
|
warning C28260: A syntax error in the annotations was found while parsing for a property inside a function |
|
A syntax error in the annotations was found for the property in the function. |
|
warning C28268: The function class on the function does not match the function class on the typedef used here |
|
warning C28601: Avoid blocking on HWND_BROADCAST |
|
warning C28602: Avoid calling SendMessageTimeout with HWND_BROADCAST |
|
warning C28604: Avoid calling SendMessageTimeout with SMTO_ABORTIFHUNG with a timeout of 0 |
|
warning C28615: Must call _resetstkoflw in the __except() block when calling _alloca in the __try block. Don't call _resetstkoflw from inside a catch() block |
|
warning C28616: Multithreaded AV condition |
|
warning C28617: Avoid using the return value of _beginthread(). Use _beginthreadex() instead |
|
warning C28623: Unsigned cast of GetMessagePos() coordinates. Use GET_X_LPARAM/GET_Y_LPARAM instead of LOWORD/HIWORD |
|
warning C28624: No call to Release() to match incremented refcount from LResultFromObject |
|
warning C28625: Function call used to clear sensitive data will be optimized away |
|
warning C28636: Calling LocalFree on non-allocated pointer obtained from calls to GetSecurityDescriptorOwner/Group/Dacl/Sacl |
|
warning C28637: Calling the function in a global initializer is unsafe |
|
warning C28638: function delayload stub is missing a matching declaration |
|
warning C28639: Calling close handle with string |
|
warning C28640: function delayload stub should be a static function |
|
warning C28644: Return value from DPA_InsertPtr not checked |
|
warning C28645: MessageBox was called using the question mark message symbol which is no longer recommended |
|
warning C28648: PulseEvent is an unreliable function |
|
warning C28649: Automatic or Global Stack Arrays are never NULL |
|
warning C28650: The type for which !0 is being used does not treat it as failure case. Returning a status value such as !TRUE is not the same as returning a status value that indicates failure. |
|
warning C28651: Static initializer causes copy on write pages due to member function pointers |
|
warning C28652: Static initializer causes copy on write pages due to overloaded bitwise operators |
|
warning C28714: Cast between semantically different integer types |
|
warning C28715: Cast between semantically different integer types |
|
warning C28716: Compiler-inserted cast between semantically different integral types |
|
warning C28717: Invalid VARIANT type |
|
warning C28718: Unannotated buffer |
|
warning C28719: Banned API Usage |
|
warning C28720: Banned API Usage |
|
warning C28721: Deprecated performance counter architecture |
|
warning C28722: Unannotated buffer in function declaration |
|
warning C28723: Unannotated buffer in function definition that has no corresponding declaration |
|
warning C28725: Use Watson instead of this SetUnhandledExceptionFilter |
|
warning C28726: Banned API Usage |
|
warning C28727: Banned API Usage |
|
warning C28728: Banned API Usage |
|
warning C28730: Possible assignment of '\0' directly to a pointer. |
|
warning C28735: Banned Crimson API Usage |
|
warning C28736: Banned API Argument Usage |
|
warning C28740: Unannotated unsigned buffer |
|
warning C28741: Unannotated buffer in the function |
|
warning C28742: Unannotated buffer in the function |
|
warning C28750: Banned usage of lstrlen and its variants |
|
warning C28751: Banned usage of ExAllocatePool and its variants |
|
warning C28752: Banned usage of kernel32 or advapi32 API |
|
warning C28753: Relying on undefined order of evaluation of parameters |
|
warning C30029: Calling a memory allocating function that requests executable memory |
|
warning C30030: Calling a memory allocating function and passing a parameter that indicates executable memory |
|
warning C30031: Calling a memory allocating function and passing a parameter that indicates executable memory |
|
warning C30032: Calling a memory allocating function and forcing the request of executable memory through use of the POOL_NX_OPTOUT directive |
|
warning C30033: Executable allocation was detected in a driver compiled with POOL_NX_OPTIN. This driver has been determined to be loaded at run time by another driver. Please verify that the loading driver calls ExInitializeDriverRuntime(DrvRtPoolNxOptIn) in its DriverEntry. |
|
warning C30034: Passing a flag value to an allocating function that could result in executable memory being allocated. Please verify that the allocating function is not requesting a form of executable nonpaged pool. |
|
warning C30035: A call was made to a function that must be made from inside the initialization function (for example, DriverEntry() or DllInitialize()). PREfast was unable to determine if the call was made from the initialization function. |