netfilter: x_tables: add compat version of xt_check_entry_offsets

netfilter: x_tables: add compat version of xt_check_entry_offsets

Orabug: 24690280
CVE: CVE-2016-3134

[ Upstream commit fc1221b3a163d1386d1052184202d5dc50d302d1 ]

32bit rulesets have different layout and alignment requirements, so once
more integrity checks get added to xt_check_entry_offsets it will reject
well-formed 32bit rulesets.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
(cherry picked from commit acbcf85306bd563910a2afe07f07d30381b031b0)
Signed-off-by: Brian Maly <brian.maly@oracle.com>