net: rds: fix MR cleanup on copy error

In the Linux kernel, the following vulnerability has been resolved:

net: rds: fix MR cleanup on copy error

__rds_rdma_map() hands sg/pages ownership to the transport after

get_mr() succeeds. If copying the generated cookie back to user space

fails after that point, the error path must not free those resources

again before dropping the MR reference.

Remove the duplicate unpin/free from the put_user() failure branch so

that MR teardown is handled only through the existing final cleanup

path.