[BUG?] siw: RDMA Read Request QN/MO are not validated

Hello,

Resending in plain text because the previous copy was rejected by the
mailing list.

RFC 5040 Section 7.2 requires all Untagged DDP Segment fields of an
incoming RDMA Read Request to be validated. Section 5.2.1 fixes the
RREQ Queue Number at 1, and RFC 5041 Section 4.3 requires the first
segment's Message Offset to be zero.

On Linux master commit 8ba098e6b6ff0db8edf28528d1552be261af30d4:

- siw_proc_rreq() only checks that no bytes remain after the fixed
request header:
https://github.com/torvalds/linux/blob/8ba098e6b6ff0db8edf28528d1552be261af30d4/drivers/infiniband/sw/siw/siw_qp_rx.c#L627-L638

- siw_init_rresp() validates ddp_msn, but does not read or compare
ddp_qn or ddp_mo before constructing the Read Response:
https://github.com/torvalds/linux/blob/8ba098e6b6ff0db8edf28528d1552be261af30d4/drivers/infiniband/sw/siw/siw_qp_rx.c#L656-L730

For comparison, siw_send_check_ntoh() explicitly validates QN, MSN,
and MO for incoming Send messages:
https://github.com/torvalds/linux/blob/8ba098e6b6ff0db8edf28528d1552be261af30d4/drivers/infiniband/sw/siw/siw_qp_rx.c#L277-L327

Based on static source analysis, an RREQ with ddp_qn != 1, or a
first/only segment with ddp_mo != 0, appears to reach response
construction rather than cause an Invalid QN / Invalid MO Terminate.

I have not reproduced this at packet level. Is there another
validation path I missed, or should an RREQ-specific check analogous
to siw_send_check_ntoh() be added?

References:
https://www.rfc-editor.org/rfc/rfc5040.html#section-7.2
https://www.rfc-editor.org/rfc/rfc5040.html#section-5.2.1
https://www.rfc-editor.org/rfc/rfc5041.html#section-4.3

This finding came from an academic source-level RFC consistency review.

Best regards