1 files changed, 9 insertions, 6 deletions

diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index d79b92580561..d2a8889b4c58 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1222,10 +1222,10 @@ again:
                 }
                 spin_lock_irqsave(&zone->lock, flags);
                 page = __rmqueue(zone, order, migratetype);
-                __mod_zone_page_state(zone, NR_FREE_PAGES, -(1 << order));
                 spin_unlock(&zone->lock);
                 if (!page)
                         goto failed;
+                __mod_zone_page_state(zone, NR_FREE_PAGES, -(1 << order));
         }
 
         __count_zone_vm_events(PGALLOC, zone, 1 << order);
@@ -2402,13 +2402,14 @@ int numa_zonelist_order_handler(ctl_table *table, int write,
 {
         char saved_string[NUMA_ZONELIST_ORDER_LEN];
         int ret;
+        static DEFINE_MUTEX(zl_order_mutex);
 
+        mutex_lock(&zl_order_mutex);
         if (write)
-                strncpy(saved_string, (char*)table->data,
-                        NUMA_ZONELIST_ORDER_LEN);
+                strcpy(saved_string, (char*)table->data);
         ret = proc_dostring(table, write, buffer, length, ppos);
         if (ret)
-                return ret;
+                goto out;
         if (write) {
                 int oldval = user_zonelist_order;
                 if (__parse_numa_zonelist_order((char*)table->data)) {
@@ -2421,7 +2422,9 @@ int numa_zonelist_order_handler(ctl_table *table, int write,
                 } else if (oldval != user_zonelist_order)
                         build_all_zonelists();
         }
-        return 0;
+out:
+        mutex_unlock(&zl_order_mutex);
+        return ret;
 }
 
 
@@ -3995,7 +3998,7 @@ void __init add_active_range(unsigned int nid, unsigned long start_pfn,
                 }
 
                 /* Merge backward if suitable */
-                if (start_pfn < early_node_map[i].end_pfn &&
+                if (start_pfn < early_node_map[i].start_pfn &&
                                 end_pfn >= early_node_map[i].start_pfn) {
                         early_node_map[i].start_pfn = start_pfn;
                         return;