Re: [PATCH v3 2/4] ntfs: protect attribute-list buffer replacement with attr_list_persist_lock

> @@ -153,13 +154,16 @@ int ntfs_attrlist_entry_add(struct ntfs_inode *ni, struct attr_record *attr)
>                 ntfs_debug("Attribute list isn't present.\n");
>                 return -ENOENT;
>         }
> +       mutex_lock(&ni->attr_list_persist_lock);
>
> -       /* Determine size and allocate memory for new attribute list. */
> +       /* Determine size of new attribute list entry. */
>         entry_len = (sizeof(struct attr_list_entry) + sizeof(__le16) *
>                         attr->name_length + 7) & ~7;
> -       new_al = kvzalloc(ni->attr_list_size + entry_len, GFP_NOFS);
> -       if (!new_al)
> -               return -ENOMEM;
> +
> +retry_lookup:
NInoAttrList(ni) is checked only before acquiring
attr_list_persist_lock. If another thread removes the attribute list
before this thread obtains the mutex, retry_lookup proceeds without an
attribute list. The normal lookup does not populate al_insert or
al_exact, so the generation checks can repeatedly fail and jump back
to retry_lookup while the mutex remains held. Recheck the
attribute-list state and buffer immediately after acquiring the mutex,
returning -ENOENT if they are gone.