int ntfs_external_attr_find (const ATTR_TYPE type, const ntfschar * name, const u32 name_len, const IGNORE_CASE_BOOL ic, const VCN lowest_vcn, const u8 * val, const u32 val_len, ntfs_attr_search_ctx * ctx);
You should not need to call this function directly. Use ntfs_attr_lookup instead.
Find an attribute by searching the attribute list for the corresponding attribute list entry. Having found the entry, map the mft record if the attribute is in a different mft record/inode, ntfs_attr_find the attribute in there and return it.
On first search ctx->ntfs_ino must be the base mft record and ctx must have been obtained from a call to ntfs_attr_get_search_ctx. On subsequent calls ctx->ntfs_ino can be any extent inode, too (ctx->base_ntfs_ino is then the base inode).
After finishing with the attribute/mft record you need to call ntfs_attr_put_search_ctx to cleanup the search context (unmapping any mapped inodes, etc).
If the attribute is found, ntfs_external_attr_find returns 0 and ctx->attr will point to the found attribute. ctx->mrec will point to the mft record in which ctx->attr is located and ctx->al_entry will point to the attribute list entry for the attribute.
If the attribute is not found, ntfs_external_attr_find returns -ENOENT and ctx->attr will point to the attribute in the base mft record before which the attribute being searched for would need to be inserted if such an action were to be desired. ctx->mrec will point to the mft record in which ctx->attr is located and ctx->al_entry will point to the attribute list entry of the attribute before which the attribute being searched for would need to be inserted if such an action were to be desired.
Thus to insert the not found attribute, one wants to add the attribute to ctx->mrec (the base mft record) and if there is not enough space, the attribute should be placed in a newly allocated extent mft record. The attribute list entry for the inserted attribute should be inserted in the attribute list attribute at ctx->al_entry.
On actual error, ntfs_external_attr_find returns -EIO. In this case ctx->attr is undefined and in particular do not rely on it not changing.