netdev-offload-tc: Make sure tcf_id chain doesn't exceed upper limit.

Kernel reserves the highest nibble of TCA_CHAIN for extended action
types.  This means we can't offload the recirculations with values
greater than 2^28.  Instead of kernel tc returning the error,
netdev_tc_flow_put() does the check and returns the error.

Reported-at: https://mail.openvswitch.org/pipermail/ovs-dev/2025-November/427485.html
Suggested-by: Ilya Maximets <i.maximets@ovn.org>
Acked-by: Eelco Chaudron <echaudro@redhat.com>
Signed-off-by: Numan Siddique <numans@ovn.org>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>

Author: numansiddique

lib/netdev-offload-tc.c

@@ -2329,6 +2329,12 @@ netdev_tc_flow_put(struct netdev *netdev, struct match *match,
         return -ifindex;
     }
 
+    if (key->recirc_id > TC_ACT_EXT_VAL_MASK) {
+        VLOG_DBG_RL(&rl, "flow recirc_id %u exceeds the chain id upper limit",
+                    key->recirc_id);
+        return EOPNOTSUPP;
+    }
+
     memset(&flower, 0, sizeof flower);
 
     exact_match_on_dl_type = mask->dl_type == htons(0xffff);