Observed the same crash on mainline as well (4.0.0.0-3044~kilo) with vlan sub-interface creation/deletion.
[18172.227193] Call Trace: [18172.232588] [<ffffffff812341f1>] count_subheaders+0x31/0x70 [18172.238018] [<ffffffff812341f1>] count_subheaders+0x31/0x70 [18172.243232] [<ffffffff812341f1>] count_subheaders+0x31/0x70 [18172.248258] [<ffffffff812341f1>] count_subheaders+0x31/0x70 [18172.253115] [<ffffffff812341f1>] count_subheaders+0x31/0x70 [18172.257817] [<ffffffff812341f1>] count_subheaders+0x31/0x70 [18172.262338] [<ffffffff81234b26>] unregister_sysctl_table+0x26/0x90 [18172.266803] [<ffffffff8109f6dd>] partition_sched_domains+0x3d/0x390 [18172.271188] [<ffffffff811a6fb5>] ? __kmalloc+0x55/0x250 [18172.275460] [<ffffffff810f66ca>] rebuild_sched_domains_locked+0x4a/0x60 [18172.279699] [<ffffffff810f68ed>] update_flag+0x14d/0x1a0 [18172.283819] [<ffffffff810f6ac3>] cpuset_css_offline+0x33/0x60 [18172.287901] [<ffffffff810edbe7>] offline_css+0x27/0x50 [18172.291893] [<ffffffff810f132d>] css_killed_work_fn+0x2d/0xa0 [18172.295860] [<ffffffff81086fc8>] process_one_work+0x178/0x470 [18172.299815] [<ffffffff81087de1>] worker_thread+0x121/0x410 [18172.303716] [<ffffffff81087cc0>] ? rescuer_thread+0x430/0x430 [18172.307619] [<ffffffff8108ebc9>] kthread+0xc9/0xe0 [18172.311459] [<ffffffff8108eb00>] ? kthread_create_on_node+0x1c0/0x1c0 [18172.315260] [<ffffffff8173dca8>] ret_from_fork+0x58/0x90 [18172.318990] [<ffffffff8108eb00>] ? kthread_create_on_node+0x1c0/0x1c0 [18172.322706] Code: 89 e5 48 8b 40 e0 5d 48 83 78 18 00 0f 95 c0 0f b6 c0 c3 66 90 0f 1f 44 00 00 55 48 85 ff 48 89 e5 41 55 41 54 53 48 89 fb 74 4a <48> 83 3f 00 74 44 45 31 e4 45 31 ed eb 16 0f 1f 40 00 48 83 c3 [18172.334113] RIP [<ffffffff812341d6>] count_subheaders+0x16/0x70 [18172.337773] RSP <ffff88102573db98>
Observed the same crash on mainline as well (4.0.0.0-3044~kilo) with vlan sub-interface creation/deletion.
[18172.227193] Call Trace: 1f1>] count_subheader s+0x31/ 0x70 1f1>] count_subheader s+0x31/ 0x70 1f1>] count_subheader s+0x31/ 0x70 1f1>] count_subheader s+0x31/ 0x70 1f1>] count_subheader s+0x31/ 0x70 1f1>] count_subheader s+0x31/ 0x70 b26>] unregister_ sysctl_ table+0x26/ 0x90 6dd>] partition_ sched_domains+ 0x3d/0x390 fb5>] ? __kmalloc+ 0x55/0x250 6ca>] rebuild_ sched_domains_ locked+ 0x4a/0x60 8ed>] update_ flag+0x14d/ 0x1a0 ac3>] cpuset_ css_offline+ 0x33/0x60 be7>] offline_ css+0x27/ 0x50 32d>] css_killed_ work_fn+ 0x2d/0xa0 fc8>] process_ one_work+ 0x178/0x470 de1>] worker_ thread+ 0x121/0x410 cc0>] ? rescuer_ thread+ 0x430/0x430 bc9>] kthread+0xc9/0xe0 b00>] ? kthread_ create_ on_node+ 0x1c0/0x1c0 ca8>] ret_from_ fork+0x58/ 0x90 b00>] ? kthread_ create_ on_node+ 0x1c0/0x1c0 1d6>] count_subheader s+0x16/ 0x70
[18172.232588] [<ffffffff81234
[18172.238018] [<ffffffff81234
[18172.243232] [<ffffffff81234
[18172.248258] [<ffffffff81234
[18172.253115] [<ffffffff81234
[18172.257817] [<ffffffff81234
[18172.262338] [<ffffffff81234
[18172.266803] [<ffffffff8109f
[18172.271188] [<ffffffff811a6
[18172.275460] [<ffffffff810f6
[18172.279699] [<ffffffff810f6
[18172.283819] [<ffffffff810f6
[18172.287901] [<ffffffff810ed
[18172.291893] [<ffffffff810f1
[18172.295860] [<ffffffff81086
[18172.299815] [<ffffffff81087
[18172.303716] [<ffffffff81087
[18172.307619] [<ffffffff8108e
[18172.311459] [<ffffffff8108e
[18172.315260] [<ffffffff8173d
[18172.318990] [<ffffffff8108e
[18172.322706] Code: 89 e5 48 8b 40 e0 5d 48 83 78 18 00 0f 95 c0 0f b6 c0 c3 66 90 0f 1f 44 00 00 55 48 85 ff 48 89 e5 41 55 41 54 53 48 89 fb 74 4a <48> 83 3f 00 74 44 45 31 e4 45 31 ed eb 16 0f 1f 40 00 48 83 c3
[18172.334113] RIP [<ffffffff81234
[18172.337773] RSP <ffff88102573db98>