Retrying revoke()

How about, if a process has a mapping on a revoke()d fd, it gets a SIGBUS as a notification *at the time revoke() happens*. If it tries to access the mapping, it gets a SIGSEGV.

Processes could then try to catch SIGBUS and internally mark any mmap()ed regions as invalid if they want. Or mremap() them? Which could return EINVAL rather than EFAULT for revoked mappings?

There will presumably still be race conditions where one thread might access the mapped region before the signal handler completes, but presumably that's still better than the alternative - no notice, guaranteed segv.