'/etc/init.d/network restart' or 'wifi down' causes hang

Hello world,

I'm running into a problem each time I issue a network restart command or a wifi down/up command; the system hangs - it seems to be rtnl deadlock or at least rtnl related. The only way to recover is a reboot. I appreciate any insight into the issue or a solution. Please find my setup/config below. Thank.

root@OpenWrt:~# ubus call system board
{
        "kernel": "4.4.61",
        "hostname": "OpenWrt",
        "system": "MediaTek MT7620A ver:2 eco:6",
        "model": "Ralink MT7620a + MT7610e evaluation board",
        "release": {
                "distribution": "LEDE",
                "version": "17.01.1",
                "revision": "r3316-7eb58cf109",
                "codename": "reboot",
                "target": "ramips\/mt7620",
                "description": "LEDE Reboot 17.01.1 r3316-7eb58cf109"
        }
}

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path '10180000.wmac'
        option disabled '0'
        option country 'US'
        option htmode 'HT20'
        option txpower '23'
        option frag '2346'
        option rts '1700'
        option short_gi_20 '0'
        option max_amsdu '0'
        option hwmode '11ng'
        option noscan '0'
        option log_level '0'
        option ht_coex '0'
        option ldpc '0'
        option greenfield '0'
        option tx_stbc '1'
        option rx_stbc '2'
        option dsss_cck_40 '0'
        list basic_rate '6000'
        list basic_rate '9000'
        list basic_rate '12000'
        list basic_rate '18000'
        list basic_rate '24000'
        list basic_rate '36000'
        list basic_rate '48000'
        list basic_rate '54000'
        list supported_rates '6000'
        list supported_rates '9000'
        list supported_rates '12000'
        list supported_rates '18000'
        list supported_rates '24000'
        list supported_rates '36000'
        list supported_rates '48000'
        list supported_rates '54000'
        option channel '6'

config wifi-iface
        option device 'radio0'
        option network 'lan'
        option disabled '0'
        option mode 'ap'
        option short_preamble '0'
        option ssid 'tle8f376'
        option encryption 'psk2'
        option key '0YbjiNTQkU8YzGfxuh9I5aCab9QeRTHcuulkCbPFWJQhTNkFVZYGYYGC8yOXvK'
        option wps_pushbutton '1'
        option wpa_group_rekey '86400'
        option disassoc_low_ack '0'
        option max_inactivity '1810'
        option skip_inactivity_poll '1'
        option max_listen_interval '65535'
        option isolate '1'
        option wmm '1'
        option dtim_period '1'
        option beacon_int '100'
        option ifname 'wlan1'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'pci0000:00/0000:00:00.0/0000:01:00.0'
        option hwmode '11ac'
        option htmode 'VHT80'
        option disabled '0'
        option country 'US'
        option log_level '0'
        option frag '2346'
        option rts '2347'
        option noscan '0'
        option ldpc '0'
        option greenfield '0'
        option channel '149'
        option txpower '23'

config wifi-iface
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option short_preamble '1'
        option ssid 'tle8f376-5G'
        option encryption 'psk2'
        option key '0YbjiNTQkU8YzGfxuh9I5aCab9QeRTHcuulkCbPFWJQhTNkFVZYGYYGC8yOXvK'
        option ifname 'wlan2'
        option disabled '0'

config wifi-iface
        option network 'wwan'
        option mode 'sta'
        option powersave '0'
        option ssid 'xxx'
        option encryption 'psk2+aes'
        option device 'radio1'
        option ifname 'wlan0'
        option key 'xxx'


root@OpenWrt:~# ps
  PID USER       VSZ STAT COMMAND
    1 root      1532 S    /sbin/procd
    2 root         0 SW   [kthreadd]
    3 root         0 RW   [ksoftirqd/0]
    4 root         0 SW   [kworker/0:0]
    5 root         0 SW<  [kworker/0:0H]
    7 root         0 SW   [watchdog/0]
    8 root         0 SW   [kworker/u2:1]
   41 root         0 SW   [khungtaskd]
   71 root         0 SW   [kworker/u2:3]
   72 root         0 SW<  [writeback]
   74 root         0 SW<  [crypto]
   76 root         0 SW<  [bioset]
   77 root         0 SW<  [kblockd]
  106 root         0 DW   [kworker/0:1]
  114 root         0 SW   [kswapd0]
  162 root         0 SW   [fsnotify_mark]
  171 root         0 SW   [spi0]
  197 root         0 SW<  [bioset]
  202 root         0 SW<  [bioset]
  207 root         0 SW<  [bioset]
  212 root         0 SW<  [bioset]
  217 root         0 SW<  [bioset]
  222 root         0 SW<  [bioset]
  227 root         0 SW<  [bioset]
  249 root         0 SW<  [deferwq]
  255 root         0 SW<  [kworker/0:1H]
  258 root         0 SW   [irq/40-gpio-key]
  259 root         0 SW   [irq/41-gpio-key]
  336 root         0 SWN  [jffs2_gcd_mtd6]
  386 root      1180 S    /sbin/ubusd
  387 root      1208 S    /bin/ash --
  388 root      1212 S    -ash
  443 root         0 SW<  [cfg80211]
  632 root      1420 S    /sbin/logd -S 256
  707 root      1704 S    /sbin/netifd
  752 root      1212 S    /usr/sbin/crond -f -c /etc/crontabs -l 5
  860 root      1208 S    /usr/sbin/ntpd -n -N -S /usr/sbin/ntpd-hotplug -p 0.
 1160 root      2224 R    /usr/sbin/hostapd -s -P /var/run/wifi-phy1.pid -B /v
 1175 root      2224 D    /usr/sbin/hostapd -s -P /var/run/wifi-phy0.pid -B /v
 1471 root      1392 S    {mac80211.sh} /bin/sh ./mac80211.sh mac80211 teardow
 1472 root      1388 S    {mac80211.sh} /bin/sh ./mac80211.sh mac80211 teardow
 1479 root      1328 S    ubus call network.wireless notify { "command": 3, "d
 1482 root      1328 S    ubus call network.wireless notify { "command": 3, "d
 1501 root         0 SW   [kworker/0:2]
 1552 root      2084 D    /usr/sbin/dnsmasq -C /var/etc/dnsmasq.conf.cfg02411c
 1554 root      1208 R    ps


root@OpenWrt:~# [  719.523342] INFO: task kworker/0:1:106 blocked for more than 30 seconds.
[  719.536733]       Not tainted 4.4.61 #0
[  719.544391] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  719.560007] kworker/0:1     D 8000a7ac     0   106      2 0x00100000
[  719.572722] Workqueue: events linkwatch_event
[  719.581422] Stack : 00000001 83997998 00000002 00000003 00000000 00000000 805650e8 00000001
          80b80000 83941d30 803816c4 80565124 8023358c 80565114 80b80000 8000a7ac
          83941d30 80b80000 80560000 805650e8 00000001 8000a9b0 83941d30 00000000
          80565124 8023358c 80565114 8000b804 80560000 80050954 83941d30 80b80000
          00000001 00000000 8023358c 00000000 00000001 803816b4 824c9d38 82c5fc00
          ...
[  719.652442] Call Trace:
[  719.657335] [<8000a5bc>] __schedule+0x540/0x6cc
[  719.666383] [<8000a7ac>] schedule+0x64/0x7c
[  719.674737] [<8000a9b0>] schedule_preempt_disabled+0x10/0x1c
[  719.686042] [<8000b804>] mutex_lock_nested+0x1fc/0x34c
[  719.696299] [<8023358c>] linkwatch_event+0x10/0x38
[  719.705872] [<8003b218>] process_one_work+0x248/0x3e0
[  719.715963] [<8003c2dc>] worker_thread+0x2b0/0x408
[  719.725532] [<8004083c>] kthread+0xe4/0xf8
[  719.733714] [<80004478>] ret_from_kernel_thread+0x14/0x1c
[  719.744483] 
[  719.747449] 3 locks held by kworker/0:1/106:
[  719.755964]  #0:  ("events"){......}, at: [<8003b1a0>] process_one_work+0x1d0/0x3e0
[  719.771279]  #1:  ((linkwatch_work).work){......}, at: [<8003b1a0>] process_one_work+0x1d0/0x3e0
[  719.788852]  #2:  (rtnl_mutex){......}, at: [<8023358c>] linkwatch_event+0x10/0x38
[  719.804017] INFO: task hostapd:1175 blocked for more than 30 seconds.
[  719.816875]       Not tainted 4.4.61 #0
[  719.824525] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  719.840137] hostapd         D 8000a7ac     0  1175      1 0x08100000
[  719.852823] Stack : 803816c4 80565fb0 80248644 80565fa0 00000000 00000000 805650e8 00000001
          80b80000 82cfc8f8 803816c4 80565124 8319e518 80565114 80b80000 8000a7ac
          82cfccb0 82cfcce0 82cfc8f8 805650e8 00000001 8000a9b0 82cfc8f8 8245f0c0
          80565124 8319e518 80565114 8000b804 80565f74 00000001 80b80000 82cfc8f8
          00000001 00000000 8319e518 80565fa0 80b80000 803816b4 839d7d98 80565114
          ...
[  719.923859] Call Trace:
[  719.928732] [<8000a5bc>] __schedule+0x540/0x6cc
[  719.937782] [<8000a7ac>] schedule+0x64/0x7c
[  719.946138] [<8000a9b0>] schedule_preempt_disabled+0x10/0x1c
[  719.957439] [<8000b804>] mutex_lock_nested+0x1fc/0x34c
[  719.967853] [<8319e518>] cfg80211_ch_switch_started_notify+0x304c/0x410c [cfg80211]
[  719.983207] 
[  719.986192] 3 locks held by hostapd/1175:
[  719.994190]  #0:  (cb_lock){......}, at: [<802485cc>] genl_rcv+0x20/0x48
[  720.007609]  #1:  (genl_mutex){......}, at: [<80248644>] genl_rcv_msg+0x50/0x32c
[  720.022390]  #2:  (rtnl_mutex){......}, at: [<8319e518>] cfg80211_ch_switch_started_notify+0x304c/0x410c [cfg80211]
[  720.043358] INFO: task dnsmasq:1552 blocked for more than 30 seconds.
[  720.056211]       Not tainted 4.4.61 #0
[  720.063863] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  720.079480] dnsmasq         D 8000a7ac     0  1552      1 0x08100000
[  720.092172] Stack : 00000000 82cfdb78 0000000f 0000000f 00000000 00000000 805650e8 00000001
          80b80000 82cfd790 803816c4 80565124 8022ffa4 80565114 80b80000 8000a7ac
          00000001 82ca9240 82ca9240 805650e8 00000001 8000a9b0 82cfd790 00000001
          80565124 8022ffa4 80565114 8000b804 00000000 00000001 82cfdb78 803abc74
          00000001 00000000 8022ffa4 80050bb8 00000014 803816b4 8252ddd8 839d7d98