diff -Naur linux-2.6.25/arch/x86/mm/fault-xen.c linux-2.6.25-xen/arch/x86/mm/fault-xen.c
--- linux-2.6.25/arch/x86/mm/fault-xen.c	2008-05-23 18:52:12.000000000 +0200
+++ linux-2.6.25-xen/arch/x86/mm/fault-xen.c	2008-05-23 18:47:29.000000000 +0200
@@ -590,7 +590,7 @@
 {
 	struct task_struct *tsk;
 	struct mm_struct *mm;
-	struct vm_area_struct *vma;
+	struct vm_area_struct * vma, * prev_vma;
 	unsigned long address;
 	int write, si_code;
 	int fault;
@@ -738,7 +738,13 @@
 		if (address + 65536 + 32 * sizeof(unsigned long) < regs->sp)
 			goto bad_area;
 	}
-	if (expand_stack(vma, address))
+	/*
+	 * find_vma_prev is just a bit slower, because it cannot
+	 * use the mmap_cache, so we run it only in the growsdown
+	 * slow path and we leave find_vma in the fast path.
+	 */
+	find_vma_prev(current->mm, address, &prev_vma);
+	if (expand_stack(vma, address, prev_vma))
 		goto bad_area;
 /*
  * Ok, we have a good vm_area for this memory access, so