linux-user: fix off-by-one in host_to_target_for_each_rtattr()

host_to_target_for_each_rtattr() uses "len > sizeof(struct rtattr)" as its loop condition. When the last rtattr in a netlink message has exactly sizeof(struct rtattr) (4) bytes remaining, the loop exits without byte-swapping its rta_len and rta_type. A big-endian guest then reads rta_len in the wrong byte order and fails validation. The companion function target_to_host_for_each_rtattr() correctly uses ">=" (added in commit fa2229dbf8). The kernel's RTA_OK macro also uses ">=". Fix the host_to_target direction to match. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2485 Signed-off-by: Yixin Wei <yixinwei@meta.com> Fixes: 6c5b5645ae0 ("linux-user: add rtnetlink(7) support") Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Helge Deller <deller@gmx.de> Cc: qemu-stable@nongnu.org