From 9e674ae3108a6811d0783cf81dcf5a3c42324e3b Mon Sep 17 00:00:00 2001
From: Leah Neukirchen <leah@vuxu.org>
Date: Thu, 8 Feb 2018 17:19:54 +0100
Subject: add -b for SIGBUS

---
 fail.1 |  8 ++++++--
 fail.c | 21 +++++++++++++++++++--
 2 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/fail.1 b/fail.1
index d63ea57..7f959aa 100644
--- a/fail.1
+++ b/fail.1
@@ -1,4 +1,4 @@
-.Dd July 14, 2017
+.Dd February 08, 2017
 .Dt FAIL 1
 .Os
 .Sh NAME
@@ -6,7 +6,7 @@
 .Nd crash in various possible ways
 .Sh SYNOPSIS
 .Nm
-.Op Fl 123DOacdikrst
+.Op Fl 123DOabcdikrst
 .Sh DESCRIPTION
 .Nm
 crashes in various possible ways to
@@ -45,6 +45,10 @@ Use with caution.
 .It Fl a
 Call
 .Fn abort .
+.It Fl b
+Trigger SIGBUS by accessing
+.Xr mmap 2
+memory beyond the end of a file.
 .It Fl c
 Violate a
 .Fn seccomp
diff --git a/fail.c b/fail.c
index 6e986ee..3364763 100644
--- a/fail.c
+++ b/fail.c
@@ -3,6 +3,7 @@
 #include <linux/seccomp.h>
 
 #include <sys/auxv.h>
+#include <sys/mman.h>
 #include <sys/prctl.h>
 #include <sys/ptrace.h>
 #include <sys/stat.h>
@@ -127,12 +128,27 @@ violate_seccomp()
 	chdir("/");
 }
 
+void
+mmap_sigbus()
+{
+	int fd = open("/bin/sh", O_RDONLY);
+	if (fd < 0)
+		exit(1);
+	char *m = mmap(0, 10*1024*1024, PROT_READ, MAP_SHARED, fd, 0);
+	if (m == MAP_FAILED)
+		exit(1);
+
+	((volatile char *)m)[9*1024*1024];
+
+	exit(1);
+}
+
 int
 main(int argc, char *argv[])
 {
 	int c;
 
-	while ((c = getopt(argc, argv, "123DOacdikrst")) != -1) {
+	while ((c = getopt(argc, argv, "123DOabcdikrst")) != -1) {
 		switch (c) {
 		case '1': exit(-1); break;
 		case '2': exit(2); break;
@@ -140,6 +156,7 @@ main(int argc, char *argv[])
 		case 'D': uninterruptible(); break;
 		case 'O': oom(); break;
 		case 'a': abortme(); break;
+		case 'b': mmap_sigbus(); break;
 		case 'c': violate_seccomp(); break;
 		case 'd': divtrap(); break;
 		case 'i': illegalins(); break;
@@ -150,6 +167,6 @@ main(int argc, char *argv[])
 		}
 	}
 
-	write(2, "Usage: fail [-123Oacdikrst]\n", 28);
+	write(2, "Usage: fail [-123Oabcdikrst]\n", 29);
 	exit(1);
 }
-- 
cgit 1.4.1