|WARNING| net/mlx5: reject unsupported layers before GRE and NVGRE

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: WARNING
https://dpdk.org/patch/172728

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-11-08

# DPDK Patch Review

## Patch Summary
The patch adds validation to reject unsupported protocol layers before GRE and NVGRE tunnel items in mlx5 flow rules.

## Review

### ERRORS

**1. Incorrect bitmask check for ESP (Error - Correctness Bug)**

Line: `MLX5_FLOW_ITEM_ESP`

The code checks `MLX5_FLOW_ITEM_ESP` in the bitmask test, but `item_flags` holds layer bitmasks with prefix `MLX5_FLOW_LAYER_*` or `MLX5_FLOW_LAYER_OUTER_*`, not item type values with prefix `MLX5_FLOW_ITEM_*`. The correct constant should be `MLX5_FLOW_LAYER_ESP` or similar, matching the pattern of the other flags in the same conditional (`MLX5_FLOW_LAYER_OUTER_L4_TCP`, `MLX5_FLOW_LAYER_ICMP`, `MLX5_FLOW_LAYER_ICMP6`).

This means the ESP check will never trigger even when an ESP item is present, allowing invalid `eth / ipv4 / esp / gre` patterns to be silently accepted when they should be rejected.

**Suggested fix:**
```c
if (item_flags & (MLX5_FLOW_LAYER_OUTER_L4_TCP |
		  MLX5_FLOW_LAYER_ICMP | MLX5_FLOW_LAYER_ICMP6 |
		  MLX5_FLOW_LAYER_ESP))
```

This error appears twice in the patch (once in `mlx5_flow_validate_item_gre` and once in `mlx5_flow_validate_item_nvgre`).

---

Review-Result: ERROR