/* mm/slab_common.c */
struct kmem_cache *kmem_cache_create(
    const char *name,
    unsigned int object_size,
    unsigned int align,
    slab_flags_t flags,            /* SLAB_HWCACHE_ALIGN | SLAB_PANIC | ... */
    void (*ctor)(void *))
{
    return kmem_cache_create_usercopy(name, object_size, align,
                                      flags, 0, 0, NULL);
}

/* → __kmem_cache_create() → mm/slub.c: kmem_cache_open() */
static int kmem_cache_open(struct kmem_cache *s, slab_flags_t flags)
{
    s->flags = kmem_cache_flags(s->size, flags, s->name);
    set_min_partial(s, ilog2(s->size) / 2);
    set_cpu_partial(s);           /* cpu_partial threshold          */
    init_kmem_cache_nodes(s);     /* alloc kmem_cache_node per NUMA */
    alloc_kmem_cache_cpus(s);     /* alloc percpu kmem_cache_cpu    */
    /* s->offset: freepointer offset di dalam object                */
    /* s->random: XOR key untuk FREELIST_HARDENED                   */
    /* s->oo:     optimal order (slab page order)                   */
    return 0;
}

/* Exploit: extend UAF window dengan RCU readlock */
rcu_read_lock();
up = uid_hash_find(uid);  /* safe even post-free */
rcu_read_unlock();

/* Attacker window: kfree() → rcu callback → page_free */
/* Dalam window itu, object masih readable/writable     */
/* Used in: cred UAF, net/sock UAF chains               */

/* Misal: kmem_cache_create("foo", 48, 0, SLAB_HWCACHE_ALIGN, NULL) */
/* s->object_size = 48, tapi s->size = 64 (rounded to cacheline)   */
/* 16 bytes padding antara objek — bisa jadi OOB write target       */
/* atau freepointer overlap jika cache non-hardened                 */

/* Freepointer disimpan DALAM object itu sendiri, di s->offset */
/* Default: s->offset = 0 (awal object)                        */

/* Tanpa FREELIST_HARDENED (kernel lama / debug off): */
next_obj = *(void **)((char *)object + s->offset);

/* Dengan CONFIG_SLAB_FREELIST_HARDENED (default Linux 5+): */
static inline void *freelist_ptr_decode(const struct kmem_cache *s,
                                         void *ptr, unsigned long ptr_addr)
{
    return (void *)((unsigned long)ptr ^ s->random ^ ptr_addr);
}

/* Stored value = fp XOR s->random XOR &(object->fp_field) */
/* Untuk forge: butuh leak s->random + heap address        */

/* Layout per-object (SLUB, no debug flags): */
/*                                                                    */
/* Object offset 0 (saat FREED):                                      */
/* [freepointer/encoded next ptr] ← s->offset bytes from start        */
/* [.... user data padding ....]                                       */
/*                                                                    */
/* Object offset 0 (saat ALLOCATED):                                  */
/* [.... user data ............] ← freeptr di-overwrite saat alloc    */
/*                                                                    */
/* Dengan KASAN:  [ user_data | redzone | kasan_meta ]                */
/* Dengan DEBUG:  [ red_left | user_data | red_right | padding ]      */
/*                                                                    */
/* Freepointer di dalam object = SLUB tidak butuh external metadata   */
/* (berbeda dengan dlmalloc yang pakai header/footer per chunk)       */

/* virt_to_slab() — dari pointer ke slab descriptor: */
static inline struct slab *virt_to_slab(const void *addr) {
    struct folio *folio = virt_to_folio(addr);
    if (!folio_test_slab(folio)) return NULL;
    return folio_slab(folio);
}

/* slab->inuse  = jumlah objek yang currently allocated                */
/* slab->objects = total objects dalam slab page (capacity)            */
/* inuse == 0        → EMPTY, eligible for discard_slab()             */
/* 0 < inuse < objs  → PARTIAL, masuk partial list                    */
/* inuse == objects  → FULL, keluar dari semua list (unreachable)      */
/*                                                                    */
/* slab->frozen (1 bit): slab sedang "dimiliki" oleh cpu_slab         */
/* saat frozen=1: free path butuh cmpxchg, bukan lock                 */

/* mm/slub.c — do_slab_free() */
static void do_slab_free(struct kmem_cache *s, struct slab *slab,
                         void *head, void *tail, int cnt, ...)
{
    struct kmem_cache_cpu *c;
    void *prior;
    unsigned long tid;
redo:
    c   = raw_cpu_ptr(s->cpu_slab);
    tid = READ_ONCE(c->tid);
    barrier();

    if (likely(slab == READ_ONCE(c->slab))) {
        /* Fast path: LIFO prepend ke cpu freelist */
        prior = c->freelist;
        set_freepointer(s, tail, prior);  /* encode: tail->fp = old_head */
        if (unlikely(!this_cpu_cmpxchg_double(
                s->cpu_slab->freelist, s->cpu_slab->tid,
                prior, tid, head, next_tid(tid)))) {
            goto redo;   /* preempted, retry */
        }
    } else {
        __slab_free(s, slab, head, tail, cnt, addr);
    }
}

/* __slab_free — slab bukan cpu_slab aktif */
static void __slab_free(struct kmem_cache *s, struct slab *slab, ...)
{
    unsigned long prior, counters, flags;
    bool was_frozen;
    struct kmem_cache_node *n;

    /* cmpxchg slab->freelist: old_fp → head (prepend) */
    prior = slab->counters;
    /* update inuse-- via cmpxchg on counters word     */

    was_frozen = (prior & SLAB_FROZEN);
    if (slab->inuse == 0 && !was_frozen) {
        /* EMPTY: discard atau keep sebagai partial */
        if (n->nr_partial > s->min_partial)
            goto slab_empty;  /* → __free_pages() */
        add_partial(n, slab, DEACTIVATE_TO_TAIL);
    } else if (was_full) {
        /* FULL → PARTIAL: tambah ke node partial list */
        add_partial(n, slab, DEACTIVATE_TO_TAIL);
    }
}