diff --git a/[refs] b/[refs]
index 31836d3354ee..0155c3a4f795 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 998de4acb2ba188d20768d1065658377a2e7d29b
+refs/heads/master: 9b61a4d1b2064dbd0c9e61754305ac852170509f
diff --git a/trunk/arch/arm/mm/fault.c b/trunk/arch/arm/mm/fault.c
index f07467533365..5bb48356d217 100644
--- a/trunk/arch/arm/mm/fault.c
+++ b/trunk/arch/arm/mm/fault.c
@@ -247,7 +247,9 @@ __do_page_fault(struct mm_struct *mm, unsigned long addr, unsigned int fsr,
 	return handle_mm_fault(mm, vma, addr & PAGE_MASK, flags);
 
 check_stack:
-	if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr))
+	/* Don't allow expansion below FIRST_USER_ADDRESS */
+	if (vma->vm_flags & VM_GROWSDOWN &&
+	    addr >= FIRST_USER_ADDRESS && !expand_stack(vma, addr))
 		goto good_area;
 out:
 	return fault;