From ad48d357dc379797214cfa6c2cc40b5cfaf5f982 Mon Sep 17 00:00:00 2001
From: Chuck Ebbert <76306.1226@compuserve.com>
Date: Fri, 23 Jun 2006 02:04:23 -0700
Subject: [PATCH] --- yaml --- r: 28986 b: refs/heads/master c:
 21528454f6dd18231ae20102f98aa8f51b6ec1b9 h: refs/heads/master v: v3

---
 [refs]                     |  2 +-
 trunk/arch/i386/mm/fault.c | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/[refs] b/[refs]
index 906d293f2061..1f7bfdcb59ab 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 1b61b910e99059abdd54c93aa70e84e076e33d16
+refs/heads/master: 21528454f6dd18231ae20102f98aa8f51b6ec1b9
diff --git a/trunk/arch/i386/mm/fault.c b/trunk/arch/i386/mm/fault.c
index 7f0fcf219a26..f38085ff3c3d 100644
--- a/trunk/arch/i386/mm/fault.c
+++ b/trunk/arch/i386/mm/fault.c
@@ -380,12 +380,12 @@ fastcall void __kprobes do_page_fault(struct pt_regs *regs,
 		goto bad_area;
 	if (error_code & 4) {
 		/*
-		 * accessing the stack below %esp is always a bug.
-		 * The "+ 32" is there due to some instructions (like
-		 * pusha) doing post-decrement on the stack and that
-		 * doesn't show up until later..
+		 * Accessing the stack below %esp is always a bug.
+		 * The large cushion allows instructions like enter
+		 * and pusha to work.  ("enter $65535,$31" pushes
+		 * 32 pointers and then decrements %esp by 65535.)
 		 */
-		if (address + 32 < regs->esp)
+		if (address + 65536 + 32 * sizeof(unsigned long) < regs->esp)
 			goto bad_area;
 	}
 	if (expand_stack(vma, address))