diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index fd20c1d9298c0cffda2d9efaf1cc4d2071e77aac..389e633e32c575fd051f634da8e36417ef199f30 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -1406,13 +1406,18 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b
 	mutex_unlock(&nbd->config_lock);
 	ret = wait_event_interruptible(config->recv_wq,
 					 atomic_read(&config->recv_threads) == 0);
+
+	/*
+	 * recv_work in flush_workqueue will not get this lock, because nbd_open
+	 * will hold nbd->config_refs
+	 */
+	mutex_lock(&nbd->config_lock);
 	if (ret) {
 		sock_shutdown(nbd);
 		nbd_clear_que(nbd);
 	}
 
 	flush_workqueue(nbd->recv_workq);
-	mutex_lock(&nbd->config_lock);
 	nbd_bdev_reset(bdev);
 	/* user requested, ignore socket errors */
 	if (test_bit(NBD_RT_DISCONNECT_REQUESTED, &config->runtime_flags))