diff --git a/kexec-tools-1.101-x86-add_buffer_retry.patch b/kexec-tools-1.101-x86-add_buffer_retry.patch
new file mode 100644
index 0000000..d4b6361
--- /dev/null
+++ b/kexec-tools-1.101-x86-add_buffer_retry.patch
@@ -0,0 +1,60 @@
+--- kexec-tools-1.101/kexec/arch/i386/crashdump-x86.c.orig	2007-07-17 08:33:59.000000000 -0400
++++ kexec-tools-1.101/kexec/arch/i386/crashdump-x86.c	2007-07-17 08:34:13.000000000 -0400
+@@ -663,6 +663,7 @@ int load_crashdump_segments(struct kexec
+ 	int nr_ranges, align = 1024;
+ 	long int nr_cpus = 0;
+ 	struct memory_range *mem_range, *memmap_p;
++	int i;
+ 
+ 	if (get_crash_memory_ranges(&mem_range, &nr_ranges) < 0)
+ 		return -1;
+@@ -720,8 +721,13 @@ int load_crashdump_segments(struct kexec
+ 	 * elf core header segment to 16K to avoid being placed in such gaps.
+ 	 * This is a makeshift solution until it is fixed in kernel.
+ 	 */
+-	elfcorehdr = add_buffer(info, tmp, sz, 16*1024, align, min_base,
+-							max_addr, -1);
++	for (i=0;i<KEXEC_MAX_SEGMENTS;i++) {
++		if ((memmap_p[i].start == 0) &&
++		    (memmap_p[i].end == 0))
++			break;
++	}
++	elfcorehdr = add_buffer(info, tmp, sz, 16*1024, align, min_base, 
++				memmap_p[i-1].end, -1);
+ 	dfprintf(stdout, "Created elf header segment at 0x%lx\n", elfcorehdr);
+ 	if (delete_memmap(memmap_p, elfcorehdr, sz) < 0)
+ 		return -1;
+--- kexec-tools-1.101/kexec/kexec.c.orig	2007-07-17 08:34:00.000000000 -0400
++++ kexec-tools-1.101/kexec/kexec.c	2007-07-17 08:34:13.000000000 -0400
+@@ -327,6 +327,7 @@ unsigned long add_buffer(struct kexec_in
+ 	unsigned long base;
+ 	int result;
+ 	int pagesize;
++	int i;
+ 
+ 	result = sort_segments(info);
+ 	if (result < 0) {
+@@ -336,11 +337,22 @@ unsigned long add_buffer(struct kexec_in
+ 	/* Round memsz up to a multiple of pagesize */
+ 	pagesize = getpagesize();
+ 	memsz = (memsz + (pagesize - 1)) & ~(pagesize - 1);
+-
++retry:
+ 	base = locate_hole(info, memsz, buf_align, buf_min, buf_max, buf_end);
+ 	if (base == ULONG_MAX) {
+ 		die("locate_hole failed\n");
+ 	}
++
++	for (i = 0; i < info->nr_segments; i++) {
++		if ((base < (info->segment[i].mem + info->segment[i].memsz)) &&
++			((base+memsz) > info->segment[i].mem)) {
++			/*
++			 *we have an overlap, bump down buf_max
++			 */
++			buf_max = (unsigned long)info->segment[i].mem;
++			goto retry;
++		}
++	}
+ 	
+ 	add_segment(info, buf, bufsz, base, memsz);
+ 	return base;
diff --git a/kexec-tools.spec b/kexec-tools.spec
index 7c1a580..750f019 100644
--- a/kexec-tools.spec
+++ b/kexec-tools.spec
@@ -1,6 +1,6 @@
 Name: kexec-tools
 Version: 1.101
-Release: 73%{?dist}
+Release: 74%{?dist}
 License: GPL
 Group: Applications/System
 Summary: The kexec/kdump userspace component.
@@ -88,6 +88,7 @@ Patch603: kexec-tools-1.101-page_h.patch
 Patch604: kexec-tools-1.101-elf-format.patch
 Patch605: kexec-tools-1.101-ifdown.patch
 Patch606: kexec-tools-1.101-reloc-update.patch
+Patch607: kexec-tools-1.101-x86-add_buffer_retry.patch
 
 %description
 kexec-tools provides /sbin/kexec binary that facilitates a new
@@ -138,6 +139,7 @@ tar -z -x -v -f %{SOURCE9}
 %patch604 -p1
 %patch605 -p1
 %patch606 -p1
+%patch607 -p1
 
 tar -z -x -v -f %{SOURCE13}
 
@@ -250,6 +252,9 @@ rm -f %{_datadir}/firstboot/modules/firstboot_kdump.py
 %doc kexec-kdump-howto.txt
 
 %changelog
+* Mon Jul 17 2007 Neil Horman <nhorman@redhat.com> - 1.101-74%{dist}
+- Fix up add_buff to retry locate_hole on segment overlap (bz 247989)
+
 * Mon Jul 09 2007 Neil Horman <nhorman@redhat.com> - 1.101-73%{dist}
 - Fix up language files for kexec (bz 246508)