------------[ cut here ]------------
roc->started
WARNING: net/mac80211/offchannel.c:404 at ieee80211_start_next_roc+0x256/0x2d0 net/mac80211/offchannel.c:404, CPU#1: kworker/u8:2/36
Modules linked in:
CPU: 1 UID: 0 PID: 36 Comm: kworker/u8:2 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:ieee80211_start_next_roc+0x256/0x2d0 net/mac80211/offchannel.c:404
Code: d9 ff e8 bd 4d 0c f7 48 83 c4 10 5b 5d c3 cc cc cc cc e8 ad 4d 0c f7 48 89 df e8 15 60 ff ff e9 36 ff ff ff e8 9b 4d 0c f7 90 <0f> 0b 90 e9 28 ff ff ff 48 c7 c7 e4 ba d7 90 e8 76 06 7a f7 e9 d1
RSP: 0018:ffffc90000ac7a48 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff888074f90f20 RCX: ffffffff8afc4046
RDX: ffff88802129ca00 RSI: ffffffff8afc4185 RDI: ffff88802129ca00
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000001
R13: ffff888074f90f20 R14: dffffc0000000000 R15: ffff888074f929a0
FS:  0000000000000000(0000) GS:ffff888124479000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555567c724e8 CR3: 0000000037e8e000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __ieee80211_scan_completed+0x4fd/0xe40 net/mac80211/scan.c:537
 ieee80211_scan_work+0x472/0x1ff0 net/mac80211/scan.c:1193
 cfg80211_wiphy_work+0x410/0x570 net/wireless/core.c:513
 process_one_work+0xa0e/0x1980 kernel/workqueue.c:3302
 process_scheduled_works kernel/workqueue.c:3385 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3466
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>