diff --git a/[refs] b/[refs]
index 0e240d4c58da..8077d1879f7d 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: c140e110019f25ffa1c6f3f365b0c9103d0b8475
+refs/heads/master: 20aa7b21b1cbd1aa3fbf5fc14da5f7484a61a824
diff --git a/trunk/include/linux/uaccess.h b/trunk/include/linux/uaccess.h
index 67918c22339c..76c3fe325101 100644
--- a/trunk/include/linux/uaccess.h
+++ b/trunk/include/linux/uaccess.h
@@ -65,14 +65,22 @@ static inline unsigned long __copy_from_user_nocache(void *to,
  * do_page_fault() doesn't attempt to take mmap_sem.  This makes
  * probe_kernel_address() suitable for use within regions where the caller
  * already holds mmap_sem, or other locks which nest inside mmap_sem.
+ * This must be a macro because __get_user() needs to know the types of the
+ * args.
+ *
+ * We don't include enough header files to be able to do the set_fs().  We
+ * require that the probe_kernel_address() caller will do that.
  */
 #define probe_kernel_address(addr, retval)		\
 	({						\
 		long ret;				\
+		mm_segment_t old_fs = get_fs();		\
 							\
+		set_fs(KERNEL_DS);			\
 		pagefault_disable();			\
 		ret = __get_user(retval, addr);		\
 		pagefault_enable();			\
+		set_fs(old_fs);				\
 		ret;					\
 	})