diff --git a/Mesa.changes b/Mesa.changes
index 66c8c9f..abc32d6 100644
--- a/Mesa.changes
+++ b/Mesa.changes
@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Mon Dec 12 14:22:12 UTC 2016 - mstaudt@suse.com
+
+- U_cso-don-t-release-sampler-states-that-are-bound.patch:
+  This avoids Radeon hangs due to a use-after-free bug in Gallium.
+  Fixes (boo#1015012), (fdo#93649)
+
 -------------------------------------------------------------------
 Mon Nov 28 19:36:00 UTC 2016 - mimi.vx@gmail.com
 
diff --git a/Mesa.spec b/Mesa.spec
index aa06459..7d17032 100644
--- a/Mesa.spec
+++ b/Mesa.spec
@@ -74,6 +74,8 @@ Patch15:        u_mesa-8.0-llvmpipe-shmget.patch
 Patch18:        n_VDPAU-XVMC-libs-Replace-hardlinks-with-copies.patch
 # never to be upstreamed
 Patch21:        n_Define-GLAPIVAR-separate-from-GLAPI.patch
+# Already upstream
+Patch22:        U_cso-don-t-release-sampler-states-that-are-bound.patch
 
 # Nouveau multithreading workarounds from https://github.com/imirkin/mesa/commits/locking
 Patch61:        N_01-WIP-nouveau-add-locking.patch
@@ -452,8 +454,8 @@ implementation of Mesa.
 %if 0%{?with_nine}
 %package libd3d
 Summary:        Mesa Direct3D9 state tracker
-# Manually provide d3d library (bnc#918294)
 Group:          System/Libraries
+# Manually provide d3d library (bnc#918294)
 %ifarch x86_64 s390x ppc64le aarch64
 Provides:       d3dadapter9.so.1()(64bit)
 %else
@@ -603,6 +605,7 @@ rm -rf docs/README.{VMS,WIN32,OS2}
 #%patch13 -p1
 %patch18 -p1
 %patch21 -p1
+%patch22 -p1
 
 %if %{use_broken_nouveau_locking_patches}
 %patch61 -p1
diff --git a/U_cso-don-t-release-sampler-states-that-are-bound.patch b/U_cso-don-t-release-sampler-states-that-are-bound.patch
new file mode 100644
index 0000000..63e17ef
--- /dev/null
+++ b/U_cso-don-t-release-sampler-states-that-are-bound.patch
@@ -0,0 +1,39 @@
+From: Marek Olšák <marek.olsak@amd.com>
+Date: Fri Dec 2 15:39:25 2016 +0100
+Subject: [PATCH]cso: don't release sampler states that are bound
+Patch-mainline: 6dc96de303290e8d1fc294da478c4f370be98dea
+Git-repo: git://anongit.freedesktop.org/mesa/mesa
+Git-commit: 6dc96de303290e8d1fc294da478c4f370be98dea
+References: boo#1015012 fdo#93649
+Signed-off-by: Max Staudt <mstaudt@suse.de>
+
+This fixes random radeonsi GPU hangs in Batman Arkham: Origins (Wine) and
+probably many other games too.
+
+cso_cache deletes sampler states when the cache size is too big and doesn't
+check which sampler states are bound, causing use-after-free in drivers.
+Because of that, radeonsi uploaded garbage sampler states and the hardware
+went bananas. Other drivers may have experienced similar issues.
+
+Cc: 12.0 13.0 <mesa-stable@lists.freedesktop.org>
+Reviewed-by: Nicolai Hähnle <nicolai.haehnle@amd.com>
+Reviewed-by: Edward O'Callaghan <funfunctor@folklore1984.net>
+---
+ src/gallium/auxiliary/cso_cache/cso_cache.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/src/gallium/auxiliary/cso_cache/cso_cache.c b/src/gallium/auxiliary/cso_cache/cso_cache.c
+index b240c93..1f3be4b 100644
+--- a/src/gallium/auxiliary/cso_cache/cso_cache.c
++++ b/src/gallium/auxiliary/cso_cache/cso_cache.c
+@@ -188,7 +188,9 @@ cso_insert_state(struct cso_cache *sc,
+                  void *state)
+ {
+    struct cso_hash *hash = _cso_hash_for_type(sc, type);
+-   sanitize_hash(sc, hash, type, sc->max_size);
++
++   if (type != CSO_SAMPLER)
++      sanitize_hash(sc, hash, type, sc->max_size);
+ 
+    return cso_hash_insert(hash, hash_key, state);
+ }