systrap: handle syscall errors

PiperOrigin-RevId: 620610190

pkg/sentry/platform/systrap/syscall_thread.go

@@ -167,6 +167,8 @@ func (t *syscallThread) attach() error {
 	return nil
 }
 
+const maxErrno = 4095
+
 func (t *syscallThread) syscall(sysno uintptr, args ...arch.SyscallArgument) (uintptr, error) {
 	if t.subproc.dead.Load() {
 		return 0, errDeadSubprocess
@@ -192,5 +194,10 @@ func (t *syscallThread) syscall(sysno uintptr, args ...arch.SyscallArgument) (ui
 	// returns only only when the other side will call FUTEX_WAKE.
 	futexWaitWake(&sentryMsg.state, atomic.LoadUint32(&sentryMsg.state))
 
+	errno := -uintptr(stubMsg.ret)
+	if errno > 0 && errno < maxErrno {
+		return 0, fmt.Errorf("stub syscall (%x, %#v) failed with %w", sysno, args, unix.Errno(errno))
+	}
+
 	return uintptr(stubMsg.ret), nil
 }