diff --git a/hadoop-common-project/hadoop-common/CHANGES.txt b/hadoop-common-project/hadoop-common/CHANGES.txt
index c8e204d2853..c9a635254e0 100644
--- a/hadoop-common-project/hadoop-common/CHANGES.txt
+++ b/hadoop-common-project/hadoop-common/CHANGES.txt
@@ -56,6 +56,8 @@ Release 2.4.0 - UNRELEASED
     HADOOP-10249. LdapGroupsMapping should trim ldap password read from file.
     (Dilli Armugam via suresh)
 
+    HADOOP-10346. Deadlock while logging tokens (jlowe)
+
 Release 2.3.1 - UNRELEASED
 
   INCOMPATIBLE CHANGES
diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/Token.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/Token.java
index 14d81910b51..3944ad12825 100644
--- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/Token.java
+++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/Token.java
@@ -105,18 +105,21 @@ public class Token<T extends TokenIdentifier> implements Writable {
     return identifier;
   }
   
-  private static synchronized Class<? extends TokenIdentifier>
+  private static Class<? extends TokenIdentifier>
       getClassForIdentifier(Text kind) {
-    if (tokenKindMap == null) {
-      tokenKindMap = Maps.newHashMap();
-      for (TokenIdentifier id : ServiceLoader.load(TokenIdentifier.class)) {
-        tokenKindMap.put(id.getKind(), id.getClass());
+    Class<? extends TokenIdentifier> cls = null;
+    synchronized (Token.class) {
+      if (tokenKindMap == null) {
+        tokenKindMap = Maps.newHashMap();
+        for (TokenIdentifier id : ServiceLoader.load(TokenIdentifier.class)) {
+          tokenKindMap.put(id.getKind(), id.getClass());
+        }
       }
+      cls = tokenKindMap.get(kind);
     }
-    Class<? extends TokenIdentifier> cls = tokenKindMap.get(kind);
     if (cls == null) {
       LOG.warn("Cannot find class for token kind " + kind);
-       return null;
+      return null;
     }
     return cls;
   }