hook SIGSEGV

[Yann Droneaud]

Hi,

Le mardi 13 mai 2014 à 17:29 +0200,
michi1 at michaelblizek.twilightparadox.com a écrit :

> On 21:46 Sat 10 May     , net.study.sea at gmail.com wrote:
> > 
> > Hi all :
> >      I want to know is it possible to hook SIGSEGV to restart the thread which the signal is sent to,without restart the whole process? And record the place where has caused this signal?
> > 
> > Thanks!
> 
> Yes, you can hook SIGSEGV like a normal signal. However, I have never tried to
> do so...
> 

I've played with this: in the segv signal handler, using SA_SIGINFO 
(see sigaction(3), I've retrieved the fault address and mmap() some 
anonymous memory page here, then leave the handler.
At this point the kernel will resume the process/thread where it has 
triggered the fault. And voila. The process/thread will issue again the 
previously faulty instruction and succeed.

This approach works when fault happen on a unmapped address.

But if your process/thread is trying to read some values there and
instead found a page full of 0, it might trigger more segfault.
Especially if it's using the zero as a pointer: it's going to try to 
access to page 0, which, by default, is not map'able by userspace 
process to defeat kernel NULL pointer dereference vulns.

For write access to a read only page, depending on the underlying
mapping, you will not be able to recover from the error easily: You
probably have to unmap the read-only page, map an anonymous page
instead, and don't forget to restore the content the process was
expected to find there.

I've never tried the later, nor played with multiple threads triggering
fault. So YMMV.

Regards.

-- 
Yann Droneaud
OPTEYA