请问这个链表为什么会出现循环输出第一组数的情况

Question

 #include<stdio.h>
#include<stdlib.h>//含malloc.h
#include<malloc.h>
#define LEN sizeof( Faction)
//一元多项式结构体
typedef struct Faction{
    int coefficient;//系数
    int exponent;//指数
    struct Faction *next;
}Faction;
//创建链表
Faction *creat() {
    Faction *head, *p1, *p2;
    head = NULL;
    p1 = p2 = (Faction*)malloc(LEN);
    scanf("%d %d", &(p1->coefficient), &(p1->exponent));
    p1->next = NULL;
    while(p1->coefficient != -1 || p1->exponent != -1) {
        if(head == NULL)
            head = p1;
        else
            p2->next = p1;
        p2 = p1;
        p1 = (Faction*)malloc(LEN);
        scanf("%d %d", &(p1->coefficient), &(p1->exponent));//此处可以顺便统数据个数
    }
    p2->next = NULL;
    free(p1);
    p1 = NULL;
    return head;
}
//输出链表
void Print(Faction *head) {
    Faction *p;
    p = head;
    while(p != NULL) {
            printf("%d %d\ ", p->coefficient, p->exponent);//空格就是\
            p = p->next;
    }
}
//计算降幂
void calculate(Faction *head) {
    Faction *p;
    p = head;
    if(head != NULL) {
        do{
            p->coefficient = p->coefficient * p->exponent;
            p->exponent -= p->exponent;
            if(p->coefficient == 0) {
                p->next = NULL;
            }
            p = p->next;
        }while(p->next != NULL);
    }
}
//
int main() {
    Faction *head;
    //head = NULL;
    head = creat();
//  calculate(head);
    Print(head);
    return 0;
}

Answer 1

那就是p->next指向有问题了
creat中的while循环，内部操作的都是已经存在的指针，并没有创建新指针，这里应该导致了指向地址都是同一个