------------[ cut here ]------------
roc->started
WARNING: net/mac80211/offchannel.c:402 at ieee80211_start_next_roc+0x256/0x2d0 net/mac80211/offchannel.c:402, CPU#1: syz-executor174/3626
Modules linked in:
CPU: 1 UID: 0 PID: 3626 Comm: syz-executor174 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
RIP: 0010:ieee80211_start_next_roc+0x256/0x2d0 net/mac80211/offchannel.c:402
Code: d8 ff e8 bd d7 cc f6 48 83 c4 10 5b 5d c3 cc cc cc cc e8 ad d7 cc f6 48 89 df e8 75 61 ff ff e9 36 ff ff ff e8 9b d7 cc f6 90 <0f> 0b 90 e9 28 ff ff ff 48 c7 c7 04 08 45 91 e8 46 e9 3f f7 e9 d1
RSP: 0018:ffffc90007a270d0 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff888145ac0f40 RCX: 0000000000000000
RDX: ffff88806e61a580 RSI: ffffffff8b3eff95 RDI: ffff88806e61a580
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000001
R13: 0000000000000000 R14: dffffc0000000000 R15: ffff888145ac2a18
FS:  0000555558dd9400(0000) GS:ffff888123c69000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1390bd1500 CR3: 0000000071c89000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __ieee80211_scan_completed+0x4fd/0xe30 net/mac80211/scan.c:537
 ieee80211_scan_cancel+0x1cf/0x960 net/mac80211/scan.c:1328
 ieee80211_do_stop+0x1f47/0x2bb0 net/mac80211/iface.c:500
 ieee80211_runtime_change_iftype net/mac80211/iface.c:2045 [inline]
 ieee80211_if_change_type+0x3c6/0x790 net/mac80211/iface.c:2083
 ieee80211_change_iface+0xad/0x920 net/mac80211/cfg.c:271
 rdev_change_virtual_intf net/wireless/rdev-ops.h:74 [inline]
 cfg80211_change_iface+0x569/0xdf0 net/wireless/util.c:1310
 nl80211_set_interface+0x875/0xc80 net/wireless/nl80211.c:5108
 genl_family_rcv_msg_doit+0x214/0x300 net/netlink/genetlink.c:1114
 genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline]
 genl_rcv_msg+0x560/0x800 net/netlink/genetlink.c:1209
 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2556
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x585/0x850 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1900
 sock_sendmsg_nosec net/socket.c:800 [inline]
 __sock_sendmsg net/socket.c:815 [inline]
 ____sys_sendmsg+0xa4d/0xbe0 net/socket.c:2713
 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2767
 __sys_sendmsg+0x160/0x210 net/socket.c:2799
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1390baa9f9
Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff09e07998 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1390baa9f9
RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000009 R09: 0000000000000009
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 00007fff09e079b0
 </TASK>