The only possible cause that I can find for this crash is that the nfsd
thread must have still been running when nfsd_shutdown_net() and then
nfsd_shutdown_generic() were called resulting in the workqueue being
destroyed.
The threads will all have been signalled with SIGKILL, but there was no
mechanism to wait for the threads to complete.
This was changed in
Commit: 3409e4f1e8f2 ("NFSD: Make it possible to use svc_set_num_threads_sync")
Sync then threads were stopped synchronously so they were certainly all
stopped before the workqueue was removed.
NeilBrown