link_path_walk/dentry_path_raw TOCTTOU race question

Hi, I'm trying to understand what prevents TOCTTOU race conditions in dentry_path_raw and link_path_walk? What happens when somebody points a symlink path component from a dir that has the attacker is allowed to read to a dir that they are not allowed to read while link_path_walk() is doing its job? Thanks! -Riya