diff --git a/[refs] b/[refs]
index 906d293f2061..1f7bfdcb59ab 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 1b61b910e99059abdd54c93aa70e84e076e33d16
+refs/heads/master: 21528454f6dd18231ae20102f98aa8f51b6ec1b9
diff --git a/trunk/arch/i386/mm/fault.c b/trunk/arch/i386/mm/fault.c
index 7f0fcf219a26..f38085ff3c3d 100644
--- a/trunk/arch/i386/mm/fault.c
+++ b/trunk/arch/i386/mm/fault.c
@@ -380,12 +380,12 @@ fastcall void __kprobes do_page_fault(struct pt_regs *regs,
 		goto bad_area;
 	if (error_code & 4) {
 		/*
-		 * accessing the stack below %esp is always a bug.
-		 * The "+ 32" is there due to some instructions (like
-		 * pusha) doing post-decrement on the stack and that
-		 * doesn't show up until later..
+		 * Accessing the stack below %esp is always a bug.
+		 * The large cushion allows instructions like enter
+		 * and pusha to work.  ("enter $65535,$31" pushes
+		 * 32 pointers and then decrements %esp by 65535.)
 		 */
-		if (address + 32 < regs->esp)
+		if (address + 65536 + 32 * sizeof(unsigned long) < regs->esp)
 			goto bad_area;
 	}
 	if (expand_stack(vma, address))