diff --git a/[refs] b/[refs]
index 2e8b39884100..cc9cc9934f17 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 110cb1d2e343443c4a4b5f7e081928aa4da90f93
+refs/heads/master: 19964fecf25c17f865dec07ae242b1a40ea93f16
diff --git a/trunk/arch/i386/mm/fault.c b/trunk/arch/i386/mm/fault.c
index f38085ff3c3d..bd6fe96cc16d 100644
--- a/trunk/arch/i386/mm/fault.c
+++ b/trunk/arch/i386/mm/fault.c
@@ -77,12 +77,15 @@ static inline unsigned long get_segment_eip(struct pt_regs *regs,
 	unsigned seg = regs->xcs & 0xffff;
 	u32 seg_ar, seg_limit, base, *desc;
 
+	/* Unlikely, but must come before segment checks. */
+	if (unlikely(regs->eflags & VM_MASK)) {
+		base = seg << 4;
+		*eip_limit = base + 0xffff;
+		return base + (eip & 0xffff);
+	}
+
 	/* The standard kernel/user address space limit. */
 	*eip_limit = (seg & 3) ? USER_DS.seg : KERNEL_DS.seg;
-
-	/* Unlikely, but must come before segment checks. */
-	if (unlikely((regs->eflags & VM_MASK) != 0))
-		return eip + (seg << 4);
 	
 	/* By far the most common cases. */
 	if (likely(seg == __USER_CS || seg == __KERNEL_CS))