Now I know what I missed! I missed that the freepointer may no more be valid because any other preemptions. Also, It is possible that cpu_slab->freelist is unchanged but it's freepointer may be changed. This is why we guarantee that there is no update before, right? Thanks to the answer, I was able to solve my question.