diff --git a/kernelguard.py b/kernelguard.py index f086847..497137b 100644 --- a/kernelguard.py +++ b/kernelguard.py @@ -3023,10 +3023,20 @@ def detect_precision_downgrade(code: str | SubmissionFacts) -> list[dict]: }) return matches +def detect_global_sentinel_reuse(code_or_facts): + facts = ensure_submission_facts(code_or_facts) + if not facts.custom_kernel_active or not facts.ast_tree: return [] + for var in facts._none_inited: + if not re.search(r'\bglobal\s+\b' + re.escape(var) + r'\b', facts.custom_kernel_active): continue + # Pattern 1: if X is None: X = ... / return X + if re.search(r'\bif\s+\b' + re.escape(var) + r'\b\s+is\s+None\b', facts.custom_kernel_active): + return [{"pattern": "GLOBAL_SENTINEL_REUSE", "severity": "high", "evidence": f"Module-level {var}=None sentinel cache (is None guard)"}] + # Pattern 2: if X is not None and X.data_ptr() == ... : return ... + if re.search(r'\bif\s+\b' + re.escape(var) + r'\b\s+is\s+not\s+None\b', facts.custom_kernel_active): + return [{"pattern": "GLOBAL_SENTINEL_REUSE", "severity": "high", "evidence": f"Module-level {var}=None sentinel cache (is not None + data_ptr guard)"}] + return [] -# --------------------------------------------------------------------------- -# Score anomaly detection # --------------------------------------------------------------------------- def _collect_scores(metadata: Optional[dict]) -> tuple[list[float], Optional[float], Optional[float]]: @@ -3653,6 +3663,7 @@ class RulePolicy: "NEAR_CLONE_SPAM", "administrative", "support", SUSPICIOUS_ONLY, (), (), "downgrade", ), + "GLOBAL_SENTINEL_REUSE": RulePolicy("GLOBAL_SENTINEL_REUSE", "result_reuse", "hard", AUTO_FILTER, (), (), "rewrite"), } BASE_SCORE_CONFIG = { @@ -3790,6 +3801,7 @@ def support_only_patterns(matched_patterns: list[dict]) -> bool: detect_thread_injection, detect_lazy_tensor, detect_precision_downgrade, + detect_global_sentinel_reuse, ] BASE_DETECTOR_SPECS = [ @@ -3827,6 +3839,7 @@ def support_only_patterns(matched_patterns: list[dict]) -> bool: ("thread_injection", detect_thread_injection), ("lazy_tensor", detect_lazy_tensor), ("precision_downgrade", detect_precision_downgrade), + ("global_sentinel_reuse", detect_global_sentinel_reuse), ] VALID_RULE_OUTCOMES = {AUTO_FILTER, SUSPICIOUS_ONLY, TELEMETRY_ONLY}