net/mlx5e: Disable MACsec offload for uplink representor profile

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Disable MACsec offload for uplink representor profile

MACsec offload is not supported in switchdev mode for uplink

representors. When switching to the uplink representor profile, the

MACsec offload feature must be cleared from the netdevice's features.

If left enabled, attempts to add offloads result in a null pointer

dereference, as the uplink representor does not support MACsec offload

even though the feature bit remains set.

Clear NETIF_F_HW_MACSEC in mlx5e_fix_uplink_rep_features().

Kernel log:

Oops: general protection fault, probably for non-canonical address 0xdffffc000000000f: 0000 [#1] SMP KASAN

KASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f]

CPU: 29 UID: 0 PID: 4714 Comm: ip Not tainted 6.14.0-rc4_for_upstream_debug_2025_03_02_17_35 #1

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014

RIP: 0010:__mutex_lock+0x128/0x1dd0

Code: d0 7c 08 84 d2 0f 85 ad 15 00 00 8b 35 91 5c fe 03 85 f6 75 29 49 8d 7e 60 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 a6 15 00 00 4d 3b 76 60 0f 85 fd 0b 00 00 65 ff

RSP: 0018:ffff888147a4f160 EFLAGS: 00010206

RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000001

RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000078

RBP: ffff888147a4f2e0 R08: ffffffffa05d2c19 R09: 0000000000000000

R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000

R13: dffffc0000000000 R14: 0000000000000018 R15: ffff888152de0000

FS: 00007f855e27d800(0000) GS:ffff88881ee80000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00000000004e5768 CR3: 000000013ae7c005 CR4: 0000000000372eb0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000

DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400

Call Trace:

<TASK>

? die_addr+0x3d/0xa0

? exc_general_protection+0x144/0x220

? asm_exc_general_protection+0x22/0x30

? mlx5e_macsec_add_secy+0xf9/0x700 [mlx5_core]

? __mutex_lock+0x128/0x1dd0

? lockdep_set_lock_cmp_fn+0x190/0x190

? mlx5e_macsec_add_secy+0xf9/0x700 [mlx5_core]

? mutex_lock_io_nested+0x1ae0/0x1ae0

? lock_acquire+0x1c2/0x530

? macsec_upd_offload+0x145/0x380

? lockdep_hardirqs_on_prepare+0x400/0x400

? kasan_save_stack+0x30/0x40

? kasan_save_stack+0x20/0x40

? kasan_save_track+0x10/0x30

? __kasan_kmalloc+0x77/0x90

? __kmalloc_noprof+0x249/0x6b0

? genl_family_rcv_msg_attrs_parse.constprop.0+0xb5/0x240

? mlx5e_macsec_add_secy+0xf9/0x700 [mlx5_core]

mlx5e_macsec_add_secy+0xf9/0x700 [mlx5_core]

? mlx5e_macsec_add_rxsa+0x11a0/0x11a0 [mlx5_core]

macsec_update_offload+0x26c/0x820

? macsec_set_mac_address+0x4b0/0x4b0

? lockdep_hardirqs_on_prepare+0x284/0x400

? _raw_spin_unlock_irqrestore+0x47/0x50

macsec_upd_offload+0x2c8/0x380

? macsec_update_offload+0x820/0x820

? __nla_parse+0x22/0x30

? genl_family_rcv_msg_attrs_parse.constprop.0+0x15e/0x240

genl_family_rcv_msg_doit+0x1cc/0x2a0

? genl_family_rcv_msg_attrs_parse.constprop.0+0x240/0x240

? cap_capable+0xd4/0x330

genl_rcv_msg+0x3ea/0x670

? genl_family_rcv_msg_dumpit+0x2a0/0x2a0

? lockdep_set_lock_cmp_fn+0x190/0x190

? macsec_update_offload+0x820/0x820

netlink_rcv_skb+0x12b/0x390

? genl_family_rcv_msg_dumpit+0x2a0/0x2a0

? netlink_ack+0xd80/0xd80

? rwsem_down_read_slowpath+0xf90/0xf90

? netlink_deliver_tap+0xcd/0xac0

? netlink_deliver_tap+0x155/0xac0

? _copy_from_iter+0x1bb/0x12c0

genl_rcv+0x24/0x40

netlink_unicast+0x440/0x700

? netlink_attachskb+0x760/0x760

? lock_acquire+0x1c2/0x530

? __might_fault+0xbb/0x170

netlink_sendmsg+0x749/0xc10

? netlink_unicast+0x700/0x700

? __might_fault+0xbb/0x170

? netlink_unicast+0x700/0x700

__sock_sendmsg+0xc5/0x190

____sys_sendmsg+0x53f/0x760

? import_iovec+0x7/0x10

? kernel_sendmsg+0x30/0x30

? __copy_msghdr+0x3c0/0x3c0

? filter_irq_stacks+0x90/0x90

? stack_depot_save_flags+0x28/0xa30

___sys_sen

---truncated---