diff --git a/dbus.spec b/dbus.spec
index e3a7de0..89569a5 100644
--- a/dbus.spec
+++ b/dbus.spec
@@ -9,7 +9,7 @@ Summary: D-BUS message bus
 Name: dbus
 Epoch: 1
 Version: 1.2.16
-Release: 5%{?dist}
+Release: 6%{?dist}
 URL: http://www.freedesktop.org/software/dbus/
 Source0: http://dbus.freedesktop.org/releases/dbus/%{name}-%{version}.tar.gz
 Source1: doxygen_to_devhelp.xsl
@@ -41,6 +41,9 @@ Conflicts: cups < 1:1.1.20-4
 Patch0: start-early.patch
 Patch1: dbus-1.0.1-generate-xml-docs.patch
 
+# from upstream
+Patch2: fix-timeout-accounting.patch
+
 %description
 D-BUS is a system for sending messages between applications. It is
 used both for the system-wide message bus service, and as a
@@ -94,6 +97,7 @@ in this separate package so server systems need not install X.
 
 %patch0 -p1 -b .start-early
 %patch1 -p1 -b .generate-xml-docs
+%patch2 -p1 -b .fix-timeout-accounting
 
 autoreconf -f -i
 
@@ -226,6 +230,9 @@ fi
 %{_includedir}/*
 
 %changelog
+* Thu Oct  1 2009 Matthias Clasen <mclasen@redhat.com> - 1:1.2.16-6
+- Fix timeout accounting
+
 * Fri Aug 21 2009 Tomas Mraz <tmraz@redhat.com> - 1:1.2.16-5
 - rebuilt with new audit
 
diff --git a/fix-timeout-accounting.patch b/fix-timeout-accounting.patch
new file mode 100644
index 0000000..7b48a26
--- /dev/null
+++ b/fix-timeout-accounting.patch
@@ -0,0 +1,59 @@
+Index: dbus-1.2.16/dbus/dbus-connection.c
+===================================================================
+--- dbus-1.2.16.orig/dbus/dbus-connection.c	2009-10-01 14:10:21.000000000 +0100
++++ dbus-1.2.16/dbus/dbus-connection.c	2009-10-01 14:13:16.000000000 +0100
+@@ -2386,7 +2386,7 @@
+            */
+           _dbus_verbose ("dbus_connection_send_with_reply_and_block() waiting for more memory\n");
+ 
+-          _dbus_memory_pause_based_on_timeout (timeout_milliseconds);
++          _dbus_memory_pause_based_on_timeout (timeout_milliseconds - elapsed_milliseconds);
+         }
+       else
+         {          
+@@ -2394,7 +2394,7 @@
+           _dbus_connection_do_iteration_unlocked (connection,
+                                                   DBUS_ITERATION_DO_READING |
+                                                   DBUS_ITERATION_BLOCK,
+-                                                  timeout_milliseconds);
++                                                  timeout_milliseconds - elapsed_milliseconds);
+         }
+ 
+       goto recheck_status;
+@@ -2403,9 +2403,7 @@
+     _dbus_verbose ("dbus_connection_send_with_reply_and_block(): clock set backward\n");
+   else if (elapsed_milliseconds < timeout_milliseconds)
+     {
+-      timeout_milliseconds -= elapsed_milliseconds;
+-      _dbus_verbose ("dbus_connection_send_with_reply_and_block(): %d milliseconds remain\n", timeout_milliseconds);
+-      _dbus_assert (timeout_milliseconds >= 0);
++      _dbus_verbose ("dbus_connection_send_with_reply_and_block(): %d milliseconds remain\n", timeout_milliseconds - elapsed_milliseconds);
+       
+       if (status == DBUS_DISPATCH_NEED_MEMORY)
+         {
+@@ -2415,7 +2413,7 @@
+            */
+           _dbus_verbose ("dbus_connection_send_with_reply_and_block() waiting for more memory\n");
+ 
+-          _dbus_memory_pause_based_on_timeout (timeout_milliseconds);
++          _dbus_memory_pause_based_on_timeout (timeout_milliseconds - elapsed_milliseconds);
+         }
+       else
+         {          
+@@ -2423,14 +2421,14 @@
+           _dbus_connection_do_iteration_unlocked (connection,
+                                                   DBUS_ITERATION_DO_READING |
+                                                   DBUS_ITERATION_BLOCK,
+-                                                  timeout_milliseconds);
++                                                  timeout_milliseconds - elapsed_milliseconds);
+         }
+ 
+       goto recheck_status;
+     }
+ 
+   _dbus_verbose ("dbus_connection_send_with_reply_and_block(): Waited %ld milliseconds and got no reply\n",
+-                 (tv_sec - start_tv_sec) * 1000 + (tv_usec - start_tv_usec) / 1000);
++                 elapsed_milliseconds);
+ 
+   _dbus_assert (!_dbus_pending_call_get_completed_unlocked (pending));
+