bpf: Check netfilter ctx accesses are aligned

JIRA: https://issues.redhat.com/browse/RHEL-115630
Upstream Status: commit 9e6448f

commit 9e6448f
Author: Paul Chaignon <paul.chaignon@gmail.com>
Date:   Fri Aug 1 11:48:15 2025 +0200

    bpf: Check netfilter ctx accesses are aligned

    Similarly to the previous patch fixing the flow_dissector ctx accesses,
    nf_is_valid_access also doesn't check that ctx accesses are aligned.
    Contrary to flow_dissector programs, netfilter programs don't have
    context conversion. The unaligned ctx accesses are therefore allowed by
    the verifier.

    Fixes: fd9c663 ("bpf: minimal support for programs hooked into netfilter framework")
    Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
    Acked-by: Yonghong Song <yonghong.song@linux.dev>
    Acked-by: Eduard Zingerman <eddyz87@gmail.com>
    Link: https://lore.kernel.org/r/853ae9ed5edaa5196e8472ff0f1bb1cc24059214.1754039605.git.paul.chaignon@gmail.com
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>

Signed-off-by: Florian Westphal <fwestpha@redhat.com>

Author: fw-strlen

net/netfilter/nf_bpf_link.c

@@ -200,6 +200,9 @@ static bool nf_is_valid_access(int off, int size, enum bpf_access_type type,
 	if (off < 0 || off >= sizeof(struct bpf_nf_ctx))
 		return false;
 
+	if (off % size != 0)
+		return false;
+
 	if (type == BPF_WRITE)
 		return false;