It does matter; file_lock is not supposed to outlive the struct file
it refers to. If it does, and if struct file in question is later
freed, you can get the page that used to contain it mapped in userland.
Then it's not hard to fill it with the right pattern, so that e.g.
reading from /proc/locks would read data from arbitrary kernel address
and print it for you (look at the place where it prints ->i_ino,
for starters). That's already a roothole; looking for more direct
ways to escalate is left as an exercise for readers (and yes, it is
possible).