syzbot

------------[ cut here ]------------
WARNING: CPU: 0 PID: 5100 at net/mac80211/offchannel.c:401 ieee80211_start_next_roc+0x24c/0x2c0 net/mac80211/offchannel.c:401
Modules linked in:
CPU: 0 PID: 5100 Comm: syz-executor419 Not tainted 6.7.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
RIP: 0010:ieee80211_start_next_roc+0x24c/0x2c0 net/mac80211/offchannel.c:401
Code: 7b 40 e8 47 d7 de ff 48 83 c4 10 5b 5d e9 6c 9b 93 f7 e8 67 9b 93 f7 48 89 df e8 ff 62 ff ff e9 40 ff ff ff e8 55 9b 93 f7 90 <0f> 0b 90 e9 32 ff ff ff 48 c7 c7 b8 9d 18 8f e8 30 68 e9 f7 e9 db
RSP: 0018:ffffc900035bf180 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88801fc60e20 RCX: ffffffff89f2e3c6
RDX: ffff8880228c6040 RSI: ffffffff89f2e4fb RDI: 0000000000000001
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000003 R12: 0000000000000001
R13: ffff88801fc62878 R14: 0000000000000000 R15: dffffc0000000000
FS:  0000555555c2e380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff4f39e3d8 CR3: 00000000213e1000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __ieee80211_scan_completed+0x500/0xe10 net/mac80211/scan.c:475
 ieee80211_scan_cancel+0x1cf/0x940 net/mac80211/scan.c:1234
 ieee80211_do_stop+0x19d7/0x21f0 net/mac80211/iface.c:480
 ieee80211_runtime_change_iftype net/mac80211/iface.c:1854 [inline]
 ieee80211_if_change_type+0x364/0x7a0 net/mac80211/iface.c:1892
 ieee80211_change_iface+0xa5/0x4f0 net/mac80211/cfg.c:219
 rdev_change_virtual_intf net/wireless/rdev-ops.h:74 [inline]
 cfg80211_change_iface+0x57d/0xd50 net/wireless/util.c:1153
 nl80211_set_interface+0x6fa/0x9a0 net/wireless/nl80211.c:4211
 genl_family_rcv_msg_doit+0x1fc/0x2e0 net/netlink/genetlink.c:972
 genl_family_rcv_msg net/netlink/genetlink.c:1052 [inline]
 genl_rcv_msg+0x561/0x800 net/netlink/genetlink.c:1067
 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2545
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076
 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]
 netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1368
 netlink_sendmsg+0x93c/0xe40 net/netlink/af_netlink.c:1910
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0xd5/0x180 net/socket.c:745
 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584
 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638
 __sys_sendmsg+0x117/0x1e0 net/socket.c:2667
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7f408acb1189
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 71 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff4f39e4d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f408acb1189
RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00000000000000a0 R09: 00000000000000a0
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 00007fff4f39e4f0
 </TASK>