[v6.1] WARNING: still has locks held in ieee80211_change_mac

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 50cbba13faa2 Linux 6.1.159
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=100d64fc580000
kernel config: https://syzkaller.appspot.com/x/.config?x=31ea1cecaf34f0db
dashboard link: https://syzkaller.appspot.com/bug?extid=3d5a349f902dcc3df89e
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=155cacfc580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=175cacb2580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7ad0bd66715a/disk-50cbba13.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3284d626258e/vmlinux-50cbba13.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a1f92ca7bbfc/Image-50cbba13.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3d5a34...@syzkaller.appspotmail.com

====================================
WARNING: syz.0.17/4458 still has locks held!
syzkaller #0 Not tainted
------------------------------------
1 lock held by syz.0.17/4458:
#0: ffff0000d6edab18 (&local->mtx){+.+.}-{3:3}, at: ieee80211_can_powered_addr_change net/mac80211/iface.c:217 [inline]
#0: ffff0000d6edab18 (&local->mtx){+.+.}-{3:3}, at: _ieee80211_change_mac net/mac80211/iface.c:272 [inline]
#0: ffff0000d6edab18 (&local->mtx){+.+.}-{3:3}, at: ieee80211_change_mac+0x630/0xe54 net/mac80211/iface.c:320

stack backtrace:
CPU: 0 PID: 4458 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
dump_stack+0x1c/0x5c lib/dump_stack.c:113
print_held_locks_bug+0xb8/0xfc kernel/locking/lockdep.c:6492
debug_check_no_locks_held+0x5c/0x74 kernel/locking/lockdep.c:6498
do_exit+0x1110/0x19a8 kernel/exit.c:902
do_group_exit+0x194/0x22c kernel/exit.c:1022
get_signal+0x11d0/0x1310 kernel/signal.c:2871
do_signal arch/arm64/kernel/signal.c:1081 [inline]
do_notify_resume+0x34c/0x2b28 arch/arm64/kernel/signal.c:1134
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
el0_svc+0x98/0x138 arch/arm64/kernel/entry-common.c:638
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup