wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
WARNING: CPU: 0 PID: 22896 at net/mac80211/offchannel.c:419 ieee80211_start_next_roc+0x1ed/0x240 net/mac80211/offchannel.c:419
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 22896 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 panic+0x26a/0x50e kernel/panic.c:186
 __warn.cold+0x20/0x5a kernel/panic.c:541
 report_bug+0x262/0x2b0 lib/bug.c:183
 fixup_bug arch/x86/kernel/traps.c:178 [inline]
 fixup_bug arch/x86/kernel/traps.c:173 [inline]
 do_error_trap+0x1d7/0x310 arch/x86/kernel/traps.c:296
 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1038
RIP: 0010:ieee80211_start_next_roc+0x1ed/0x240 net/mac80211/offchannel.c:419
Code: 98 16 00 00 48 89 ef 48 89 c2 e8 0e ec 0a 00 5b 5d e9 17 0e c9 f9 e8 12 0e c9 f9 48 89 ef e8 7a 6c ff ff eb 94 e8 03 0e c9 f9 <0f> 0b eb 8b e8 9a e8 fe f9 e9 be fe ff ff 48 c7 c7 60 f1 45 8a e8
RSP: 0018:ffff88806eb67468 EFLAGS: 00010212
RAX: 0000000000040000 RBX: 0000000000000001 RCX: ffffc90007f2b000
RDX: 0000000000003e76 RSI: ffffffff8799776d RDI: 0000000000000001
RBP: ffff88806e7c9a40 R08: 0000000000000001 R09: 0000000000000000
attempt to access beyond end of device
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000001 R14: dffffc0000000000 R15: ffff88806e7ca920
loop0: rw=2049, want=17, limit=16
Buffer I/O error on dev loop0, logical block 16, lost async page write
 __ieee80211_scan_completed+0x571/0x1690 net/mac80211/scan.c:442
 ieee80211_scan_cancel+0x340/0x940 net/mac80211/scan.c:1168
attempt to access beyond end of device
 ieee80211_do_stop+0x18c6/0x1ff0 net/mac80211/iface.c:813
audit: type=1804 audit(1640074825.268:162): pid=22899 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir075705223/syzkaller.LS7yb8/53/file0/bus" dev="loop0" ino=17 res=1
audit: type=1800 audit(1640074825.268:163): pid=22899 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.0" name="bus" dev="loop0" ino=17 res=0
 ieee80211_runtime_change_iftype net/mac80211/iface.c:1545 [inline]
 ieee80211_if_change_type+0x2b5/0x7a0 net/mac80211/iface.c:1581
loop0: rw=2049, want=18, limit=16
 ieee80211_change_iface+0x26/0x220 net/mac80211/cfg.c:157
 rdev_change_virtual_intf net/wireless/rdev-ops.h:69 [inline]
 cfg80211_change_iface+0x2e1/0x1520 net/wireless/util.c:979
 nl80211_set_interface+0x661/0x830 net/wireless/nl80211.c:3205
 genl_family_rcv_msg+0x642/0xc40 net/netlink/genetlink.c:602
Buffer I/O error on dev loop0, logical block 17, lost async page write
 genl_rcv_msg+0xbf/0x160 net/netlink/genetlink.c:627
 netlink_rcv_skb+0x160/0x440 net/netlink/af_netlink.c:2463
 genl_rcv+0x24/0x40 net/netlink/genetlink.c:638
 netlink_unicast_kernel net/netlink/af_netlink.c:1325 [inline]
 netlink_unicast+0x4d5/0x690 net/netlink/af_netlink.c:1351
 netlink_sendmsg+0x6c3/0xc50 net/netlink/af_netlink.c:1917
 sock_sendmsg_nosec net/socket.c:651 [inline]
 sock_sendmsg+0xc3/0x120 net/socket.c:661
 __sys_sendto+0x21a/0x320 net/socket.c:1899
 __do_sys_sendto net/socket.c:1911 [inline]
 __se_sys_sendto net/socket.c:1907 [inline]
 __x64_sys_sendto+0xdd/0x1b0 net/socket.c:1907
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fb69b562c5c
Code: fa fa ff ff 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 20 fb ff ff 48 8b
RSP: 002b:00007fb699f23f60 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007fb699f240d0 RCX: 00007fb69b562c5c
RDX: 0000000000000024 RSI: 00007fb699f24120 RDI: 0000000000000005
RBP: 0000000000000000 R08: 00007fb699f23fb4 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000
R13: 00007fb699f24120 R14: 0000000000000005 R15: 0000000000000000
Kernel Offset: disabled
Rebooting in 86400 seconds..