diff --git a/nss-devslot-lock.patch b/nss-devslot-lock.patch
new file mode 100644
index 0000000..3e79ac5
--- /dev/null
+++ b/nss-devslot-lock.patch
@@ -0,0 +1,36 @@
+# HG changeset patch
+# User Daiki Ueno <dueno@redhat.com>
+# Date 1500370430 -7200
+#      Tue Jul 18 11:33:50 2017 +0200
+# Branch wip/dueno/devslot-lock
+# Node ID 421c812e3143b3f7e62825cb5749e5239412c56b
+# Parent  4c1358d767de5da9a5f34afc2821b281fb37ca57
+Avoid deadlock in nssSlot_IsTokenPresent
+
+diff --git a/lib/dev/devslot.c b/lib/dev/devslot.c
+--- a/lib/dev/devslot.c
++++ b/lib/dev/devslot.c
+@@ -226,15 +226,17 @@ nssSlot_GetToken(
+     NSSSlot *slot)
+ {
+     NSSToken *rvToken = NULL;
+-    nssSlot_EnterMonitor(slot);
+ 
+-    /* Even if a token should be present, check `slot->token` too as it
+-     * might be gone already. This would happen mostly on shutdown. */
+-    if (nssSlot_IsTokenPresent(slot) && slot->token) {
+-        rvToken = nssToken_AddRef(slot->token);
++    if (nssSlot_IsTokenPresent(slot)) {
++        /* Even if a token should be present, check `slot->token` too as it
++         * might be gone already. This would happen mostly on shutdown. */
++        nssSlot_EnterMonitor(slot);
++        if (slot->token) {
++            rvToken = nssToken_AddRef(slot->token);
++        }
++        nssSlot_ExitMonitor(slot);
+     }
+ 
+-    nssSlot_ExitMonitor(slot);
+     return rvToken;
+ }
+ 
diff --git a/nss.spec b/nss.spec
index a7e5c2a..5b3bf0c 100644
--- a/nss.spec
+++ b/nss.spec
@@ -21,7 +21,7 @@ Name:             nss
 Version:          3.31.0
 # for Rawhide, please always use release >= 2
 # for Fedora release branches, please use release < 2 (1.0, 1.1, ...)
-Release:          1.0%{?dist}
+Release:          1.1%{?dist}
 License:          MPLv2.0
 URL:              http://www.mozilla.org/projects/security/pki/nss/
 Group:            System Environment/Libraries
@@ -112,6 +112,8 @@ Patch58: rhbz1185708-enable-ecc-3des-ciphers-by-default.patch
 Patch59: nss-check-policy-file.patch
 Patch62: nss-skip-util-gtest.patch
 Patch66: nss-gtests-split.patch
+# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1381784
+Patch67: nss-devslot-lock.patch
 
 %description
 Network Security Services (NSS) is a set of libraries designed to
@@ -196,6 +198,7 @@ pushd nss
 %patch59 -p1 -b .check_policy_file
 %patch62 -p1 -b .skip_util_gtest
 %patch66 -p1 -b .gtests-split
+%patch67 -p1 -b .devslot-lock
 popd
 
 #########################################################
@@ -797,6 +800,9 @@ fi
 
 
 %changelog
+* Tue Jul 18 2017 Daiki Ueno <dueno@redhat.com> - 3.31.0-1.1
+- Backport mozbz#1381784 to avoid deadlock in dnf
+
 * Wed Jun 21 2017 Daiki Ueno <dueno@redhat.com> - 3.31.0-1.0
 - Rebase to NSS 3.31.0