$ wget https://mirrors.tuna.tsinghua.edu.cn/kernel/v5.x/linux-5.19.1.tar.xz
$ tar -xvf linux-5.19.1.tar.xz
# KASAN: 设置 make menuconfig 设置"Kernel hacking" ->"Memory Debugging" -> "KASan: runtime memory debugger"。
$ make -j32
$ make all
$ make modules
# 编译出的bzImage目录：/arch/x86/boot/bzImage。

diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index a35ab8c27866e..3f935cbbaff66 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -526,7 +526,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
 	rcu_assign_pointer(f->next, f1);
 	rcu_assign_pointer(*fp, f);
 
-	if (fold && fold->handle && f->handle != fold->handle) {
+	if (fold) {
 		th = to_hash(fold->handle);
 		h = from_hash(fold->handle >> 16);
 		b = rtnl_dereference(head->table[th]);

static int route4_change(struct net *net, struct sk_buff *in_skb,
			 struct tcf_proto *tp, unsigned long base, u32 handle,
			 struct nlattr **tca, void **arg, bool ovr,
			 bool rtnl_held, struct netlink_ext_ack *extack)
{
	struct route4_filter *fold, *f1, *pfp, *f = NULL;
    fold = *arg; 	// fold 来自上层函数，根据句柄调用 route4_get() 找到现有的 route4_filter
    ...
    f = kzalloc(sizeof(struct route4_filter), GFP_KERNEL);	// [0] 分配新的 route4_filter 对象
    err = tcf_exts_init(&f->exts, net, TCA_ROUTE4_ACT, TCA_ROUTE4_POLICE); 	// route4_filter->exts.action 分配 256 字节的空间
    ...
    
    if (fold) {                                            	// [1] fold 非空, 表示对应handle 的 filter 已存在, 将 old filter 的信息拷贝到 new filter 并在 [2] 初始化 new filter
        f->id = fold->id;
        f->iif = fold->iif;
        f->res = fold->res;
        f->handle = fold->handle;

        f->tp = fold->tp;
        f->bkt = fold->bkt;
        new = false;
    }
    
    // initialize the new filter
    err = route4_set_parms(net, tp, base, f, handle, head, tb, // [2] 初始化 new filter
                   tca[TCA_RATE], new, flags, extack);
    if (err < 0)
        goto errout;

    // insert the new filter to the list
    h = from_hash(f->handle >> 16);                    		// [3] 将 new filter 插入到 list
    fp = &f->bkt->ht[h];
    for (pfp = rtnl_dereference(*fp);
         (f1 = rtnl_dereference(*fp)) != NULL;
         fp = &f1->next)
        if (f->handle < f1->handle)
            break;

    tcf_block_netif_keep_dst(tp->chain->block);
    rcu_assign_pointer(f->next, f1);
    rcu_assign_pointer(*fp, f);
    
    // remove fold filter from the list if fold exists
    if (fold && fold->handle && f->handle != fold->handle) {// [4] 若存在 old filter, 则从 list 中移除
        th = to_hash(fold->handle);
        h = from_hash(fold->handle >> 16);
        b = rtnl_dereference(head->table[th]);
        if (b) {
            fp = &b->ht[h];
            for (pfp = rtnl_dereference(*fp); pfp;
                 fp = &pfp->next, pfp = rtnl_dereference(*fp)) {
                if (pfp == fold) {
                    rcu_assign_pointer(*fp, fold->next);  [5]// remove the old from the linked list
                    break;
                }
            }
        }
    }
	...
    // free the fold filter if it exists                   	// [6] 释放 old filter
    if (fold) {
        tcf_unbind_filter(tp, &fold->res);
        tcf_exts_get_net(&fold->exts);
        tcf_queue_work(&fold->rwork, route4_delete_filter_work); // [7] 启动内核任务，调用 oute4_delete_filter_work() 释放 old filter
    }
    ...
}

static inline int tcf_exts_init(struct tcf_exts *exts, struct net *net,
				int action, int police)
{
	··· ···
	exts->actions = kcalloc(TCA_ACT_MAX_PRIO, sizeof(struct tc_action *), // 分配 32*8=256 大小的空间, 32个 tc_action 结构体指针
				GFP_KERNEL);
	··· ···
}

static void route4_delete_filter_work(struct work_struct *work)
{
	struct route4_filter *f = container_of(to_rcu_work(work),
					       struct route4_filter,
					       rwork);
	rtnl_lock();
	__route4_delete_filter(f);			// <-------
	rtnl_unlock();
}

static void __route4_delete_filter(struct route4_filter *f)
{
	tcf_exts_destroy(&f->exts); 		// <-------
	tcf_exts_put_net(&f->exts);
	kfree(f); 							// 释放 tc_action 对象
}

void tcf_exts_destroy(struct tcf_exts *exts)
{
#ifdef CONFIG_NET_CLS_ACT				// 编译时勾选 CONFIG_NET_CLS_ACT —— 默认是开启的
	if (exts->actions) {
		tcf_action_destroy(exts->actions, TCA_ACT_UNBIND);
		kfree(exts->actions); 			// 释放 tc_action 对象
	}
	exts->nr_actions = 0;
#endif
}
EXPORT_SYMBOL(tcf_exts_destroy);

static int route4_delete(struct tcf_proto *tp, void *arg, bool *last,
			 bool rtnl_held, struct netlink_ext_ack *extack)
{
	struct route4_head *head = rtnl_dereference(tp->root);
	struct route4_filter *f = arg;
	struct route4_filter __rcu **fp;
	struct route4_filter *nf;
	struct route4_bucket *b;
	...
	fp = &b->ht[from_hash(h >> 16)];
	for (nf = rtnl_dereference(*fp); nf;
	     fp = &nf->next, nf = rtnl_dereference(*fp)) {
		if (nf == f) {
			...
			tcf_queue_work(&f->rwork, route4_delete_filter_work);	// <--------
			...
		}
	}
	...
}

static inline void set_freepointer(struct kmem_cache *s, void *object, void *fp)
{
	unsigned long freeptr_addr = (unsigned long)object + s->offset;

#ifdef CONFIG_SLAB_FREELIST_HARDENED
	BUG_ON(object == fp); 			// 检测 double-free
#endif

	freeptr_addr = (unsigned long)kasan_reset_tag((void *)freeptr_addr);
	*(void **)freeptr_addr = freelist_ptr(s, fp, freeptr_addr);
}

    $4 = 0xffffffff82b13f30 <pfifo_fast_ops+16> "pfifo_fast"
    $5 = 0xffffffff82b14470 <pfifo_qdisc_ops+16> "pfifo"
    $6 = 0xffffffff82b143b0 <bfifo_qdisc_ops+16> "bfifo"
    $7 = 0xffffffff82b142f0 <pfifo_head_drop_qdisc_ops+16> "pfifo_head_drop"
    $8 = 0xffffffff82b14170 <mq_qdisc_ops+16> "mq"
    $9 = 0xffffffff82b13ff0 <noqueue_qdisc_ops+16> "noqueue"
    $10 = 0xffffffff82b14230 <blackhole_qdisc_ops+16> "blackhole"
    $11 = 0xffffffff82b14530 <qfq_qdisc_ops+16> "qfq"