When implementing a custom Mach exception handler, all recovery operations for SIGBUS/SIGSEGV except the first attempt will fail.

Recovery operations for signals SIGBUS/SIGSEGV fail when the process intercepts Mach exceptions. Only the first recovery attempt succeeds, and subsequent Signal notifications are no longer received within the process. I think this is a bug in XNU.

The test code main.c is:

If we comment out AddMachExceptionServer;, everything will return to normal.

#include <fcntl.h>
#include <mach/arm/kern_return.h>
#include <mach/kern_return.h>
#include <mach/mach.h>
#include <mach/message.h>
#include <mach/port.h>
#include <pthread.h>
#include <setjmp.h>
#include <signal.h>
#include <stdbool.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/_types/_mach_port_t.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <unistd.h>

#pragma pack(4)
typedef struct {
  mach_msg_header_t header;
  mach_msg_body_t body;
  mach_msg_port_descriptor_t thread;
  mach_msg_port_descriptor_t task;
  NDR_record_t NDR;
  exception_type_t exception;
  mach_msg_type_number_t codeCount;
  integer_t code[2];
  /** Padding to avoid RCV_TOO_LARGE. */
  char padding[512];
} MachExceptionMessage;

typedef struct {
  mach_msg_header_t header;
  NDR_record_t NDR;
  kern_return_t returnCode;
} MachReplyMessage;
#pragma pack()

static jmp_buf jump_buffer;
static void sigbus_handler(int signo, siginfo_t *info, void *context) {
  printf("Caught SIGBUS at address: %p\n", info->si_addr);
  longjmp(jump_buffer, 1);
}
static void *RunExcServer(void *userdata) {
  kern_return_t kr = KERN_FAILURE;
  mach_port_t exception_port = MACH_PORT_NULL;
  kr = mach_port_allocate(mach_task_self_, MACH_PORT_RIGHT_RECEIVE,
                          &exception_port);
  if (kr != KERN_SUCCESS) {
    printf("mach_port_allocate: %s", mach_error_string(kr));
    return NULL;
  }

  kr = mach_port_insert_right(mach_task_self_, exception_port, exception_port,
                              MACH_MSG_TYPE_MAKE_SEND);
  if (kr != KERN_SUCCESS) {
    printf("mach_port_insert_right: %s", mach_error_string(kr));
    return NULL;
  }

  kr = task_set_exception_ports(
      mach_task_self_, EXC_MASK_ALL & ~(EXC_MASK_RPC_ALERT | EXC_MASK_GUARD),
      exception_port, EXCEPTION_DEFAULT | MACH_EXCEPTION_CODES,THREAD_STATE_NONE);

if (kr != KERN_SUCCESS) {
    printf("task_set_exception_ports: %s", mach_error_string(kr));
    return NULL;
}
  MachExceptionMessage exceptionMessage = {{0}};
  MachReplyMessage replyMessage = {{0}};
  for (;;) {
    printf("Wating for message\n");
    // Wait for a message.
    kern_return_t kr = mach_msg(&exceptionMessage.header, MACH_RCV_MSG, 0,
                                sizeof(exceptionMessage), exception_port,
                                MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL);
    if (kr == KERN_SUCCESS) {
      // Send a reply saying "I didn't handle this exception".
      replyMessage.header = exceptionMessage.header;
      replyMessage.NDR = exceptionMessage.NDR;
      replyMessage.returnCode = KERN_FAILURE;
      printf("Catch exception: %d codecnt:%d code[0]: %d, code[1]: %d\n",
             exceptionMessage.exception, exceptionMessage.codeCount,
             exceptionMessage.code[0], exceptionMessage.code[1]);

      mach_msg(&replyMessage.header, MACH_SEND_MSG, sizeof(replyMessage), 0,
               MACH_PORT_NULL, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL);
    } else {
      printf("Mach error: %s\n", mach_error_string(kr));
    }
  }
  return NULL;
}

static bool AddMachExceptionServer(void) {
  int error;
  pthread_attr_t attr;
  pthread_attr_init(&attr);
  pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
  pthread_t ptid = NULL;
  error = pthread_create(&ptid, &attr, &RunExcServer, NULL);
  if (error != 0) {
    pthread_attr_destroy(&attr);
    return false;
  }
  pthread_attr_destroy(&attr);
  return true;
}

int main(int argc, char *argv[]) {
  AddMachExceptionServer();
  struct sigaction sa;
  memset(&sa, 0, sizeof(sa));
  sa.sa_sigaction = sigbus_handler;
  sa.sa_flags = SA_SIGINFO;
// #if TARGET_OS_IPHONE
//   sigaction(SIGSEGV, &sa, NULL);
// #else
  sigaction(SIGBUS, &sa, NULL);
// #endif
  int i = 0;
  while (i++ < 3) {
    printf("\nProgram start %d\n", i);
    bzero(&jump_buffer, sizeof(jump_buffer));
    if (setjmp(jump_buffer) == 0) {
      int fd = open("tempfile", O_RDWR | O_CREAT | O_TRUNC, 0666);
      ftruncate(fd, 0);
      char *map =
          (char *)mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
      close(fd);
      unlink("tempfile");
      printf("About to write to mmap of size 0 — should trigger SIGBUS...\n");
      map[0] = 'X'; // ❌ triger a SIGBUS
      munmap(map, 4096);
    } else {
      printf("Recovered from SIGBUS via longjmp!\n");
    }
  }
  printf("_exit(0)\n");
  _exit(0);
  return 0;
}