diff --git a/sgx_trts/Cargo.toml b/sgx_trts/Cargo.toml
index 9c49f4af..cb8ce89a 100644
--- a/sgx_trts/Cargo.toml
+++ b/sgx_trts/Cargo.toml
@@ -41,8 +41,7 @@ sgx_types = { path = "../sgx_types" }
 sgx_crypto_sys = { path = "../sgx_crypto/sgx_crypto_sys" }
 sgx_tlibc_sys = { path = "../sgx_libc/sgx_tlibc_sys" }
 
-intrusive-collections = { git = "https://github.com/ClawSeven/intrusive-rs.git", rev = "6d34cd7" }
-# intrusive-collections = { git = "https://github.com/ClawSeven/intrusive-rs.git", rev = "3db5618" }
+intrusive-collections = { git = "https://github.com/ClawSeven/intrusive-rs.git", rev = "152317d" }
 buddy_system_allocator = "0.9.0"
 spin = "0.9.4"
 bitflags = "1.3"
diff --git a/sgx_trts/src/emm/alloc.rs b/sgx_trts/src/emm/alloc.rs
index bc1e7f70..8388c494 100644
--- a/sgx_trts/src/emm/alloc.rs
+++ b/sgx_trts/src/emm/alloc.rs
@@ -199,7 +199,7 @@ struct BlockFree {
 #[derive(Debug)]
 struct BlockUsed {
     size: usize,
-    payload: usize,
+    payload: usize, // Act as placeholder
 }
 
 impl BlockFree {
@@ -217,6 +217,10 @@ impl BlockFree {
     fn block_size(&self) -> usize {
         self.size & SIZE_MASK
     }
+
+    fn clear_alloced(&mut self) {
+        self.size &= SIZE_MASK;
+    }
 }
 
 impl BlockUsed {
@@ -243,6 +247,43 @@ impl BlockUsed {
     fn clear_alloced(&mut self) {
         self.size &= SIZE_MASK;
     }
+
+    // Return the ptr of payload
+    fn payload_ptr(&self) -> usize {
+        &self.payload as *const _ as usize
+    }
+
+    unsafe fn with_payload<'a>(payload_ptr: usize) -> &'a mut BlockUsed {
+        let payload_ptr = payload_ptr as *const u8;
+        let block = &mut *(payload_ptr.byte_offset(-(HEADER_SIZE as isize)) as *mut BlockUsed);
+        block
+    }
+}
+
+impl<'a> From<&'a mut BlockFree> for &'a mut BlockUsed {
+    fn from(block_free: &'a mut BlockFree) -> Self {
+        let block_used = unsafe { &mut *(block_free as *mut _ as *mut BlockUsed) };
+
+        block_used.size = block_free.block_size();
+        // Clear residual link information
+        block_used.payload = 0;
+        block_used.set_alloced();
+
+        block_used
+    }
+}
+
+impl<'a> From<&'a mut BlockUsed> for &'a mut BlockFree {
+    fn from(block_used: &'a mut BlockUsed) -> Self {
+        let block_free = unsafe { &mut *(block_used as *mut _ as *mut BlockFree) };
+
+        block_free.size = block_used.block_size();
+        block_free.link = Link::new();
+        // Useless method to mark free tag
+        block_free.clear_alloced();
+
+        block_free
+    }
 }
 
 intrusive_adapter!(BlockFreeAda = UnsafeRef<BlockFree>: BlockFree { link: Link });
@@ -367,36 +408,21 @@ impl Reserve {
         idx
     }
 
-    // Reconstruct BlockUsed with BlockFree block_size() and set alloc, return payload addr.
-    // BlockFree -> BlockUsed -> Payload addr (Used)
-    fn block_to_payload(&self, block: UnsafeRef<BlockFree>) -> usize {
-        let block_size = block.block_size();
-        let mut block_used = BlockUsed::new(block_size);
-        block_used.set_alloced();
-
-        let block_used_ptr = UnsafeRef::into_raw(block) as *mut BlockUsed;
-        unsafe {
-            block_used_ptr.write(block_used);
-            // Regular offset shifts count*T bytes
-            block_used_ptr.byte_offset(HEADER_SIZE as isize) as usize
-        }
+    // Reconstruct BlockUsed with BlockFree block_size() and set alloc, return payload ptr.
+    // BlockFree -> BlockUsed -> Payload ptr (Used)
+    fn block_to_payload(&self, mut block_free: UnsafeRef<BlockFree>) -> usize {
+        // Inexplicily change inner data of pointer
+        let block_used: &mut BlockUsed = block_free.as_mut().into();
+        block_used.payload_ptr()
     }
 
-    // Reconstruct a new BlockFree with BlockUsed block_size(), return payload addr.
-    // Payload addr (Used) -> BlockUsed -> BlockFree
-    fn payload_to_block(&self, payload_addr: usize) -> UnsafeRef<BlockFree> {
-        let payload_ptr = payload_addr as *const u8;
-        let block_used_ptr =
-            unsafe { payload_ptr.byte_offset(-(HEADER_SIZE as isize)) as *mut BlockUsed };
-
-        // Implicitly clear alloc mask, reconstruct new BlockFree
-        let block_size = unsafe { block_used_ptr.read().block_size() };
-        let block_free = BlockFree::new(block_size);
-        let block_free_ptr = block_used_ptr as *mut BlockFree;
-        unsafe {
-            block_free_ptr.write(block_free);
-            UnsafeRef::from_raw(block_free_ptr)
-        }
+    // Reconstruct a new BlockFree with BlockUsed block_size(), return payload ptr.
+    // Payload ptr (Used) -> BlockUsed -> BlockFree
+    fn payload_to_block(&self, payload_ptr: usize) -> UnsafeRef<BlockFree> {
+        let block_used = unsafe { BlockUsed::with_payload(payload_ptr) };
+        // Inexplicily change inner data of pointer
+        let block_free: &mut BlockFree = block_used.into();
+        unsafe { UnsafeRef::from_raw(block_free as *const BlockFree) }
     }
 
     /// Malloc memory
diff --git a/sgx_trts/src/emm/ema.rs b/sgx_trts/src/emm/ema.rs
index bb36be17..f26e3f9b 100644
--- a/sgx_trts/src/emm/ema.rs
+++ b/sgx_trts/src/emm/ema.rs
@@ -16,10 +16,10 @@
 // under the License..
 
 use crate::arch::{SE_PAGE_SHIFT, SE_PAGE_SIZE};
+use crate::emm::alloc::EmmAllocator;
 use crate::emm::{PageInfo, PageRange, PageType, ProtFlags};
 use crate::enclave::is_within_enclave;
 use alloc::boxed::Box;
-use core::alloc::Allocator;
 use intrusive_collections::{intrusive_adapter, LinkedListLink, UnsafeRef};
 use sgx_tlibc_sys::{c_void, EACCES, EFAULT, EINVAL};
 use sgx_types::error::OsResult;
@@ -553,7 +553,7 @@ impl Ema {
     }
 
     /// Obtain the allocator of ema
-    pub fn allocator(&self) -> &'static dyn Allocator {
+    pub fn allocator(&self) -> &'static dyn EmmAllocator {
         self.alloc.alloctor()
     }
 
diff --git a/sgx_trts/src/se/report.rs b/sgx_trts/src/se/report.rs
index 0d21b221..9eab4eae 100644
--- a/sgx_trts/src/se/report.rs
+++ b/sgx_trts/src/se/report.rs
@@ -58,7 +58,7 @@ static REPORT: Once<AlignReport> = Once::new();
 
 impl AlignReport {
     pub fn get_self() -> &'static AlignReport {
-        REPORT.call_once(|| AlignReport::for_self()).unwrap()
+        REPORT.call_once(AlignReport::for_self).unwrap()
     }
 
     pub fn for_self() -> SgxResult<AlignReport> {