Re: [PATCH] pid: fix cad_pid use-after-free race in proc_do_cad_pid()

[Cen Zhang (Microsoft)]

Thanks both for the review.

One impact clarification: this is not init-namespace-root-only. The sysctl
is mode 0600, but access is checked against the owning user namespace, so
an unprivileged user can reach it via userns + pidns + a proc mount.

The demonstrated impact is a KASAN UAF. On non-debug builds the
proc_do_cad_pid() read path likely only returns a stale pid value unless
the freed pid object is reused in a very tight window.

I'll send a v2 series as suggested: patch 1 deinlines kill_cad_pid()
without functional changes, and patch 2 contains the updated fix.