CVE-2026-90081: net/rds: use wq_has_sleeper() in rds_cong_map_updated()

In the Linux kernel, the following vulnerability has been resolved:

net/rds: use wqhassleeper() in rdscongmapupdated()

rdscongmapupdated() runs after a peer's congestion map has been rewritten (by rdstcpcongrecv() and rdsibcongrecv(), or the clear-all in the loopback and IB send-completion paths). It bumps rdsconggeneration and then checks waitqueueactive() on map->mwaitq and on rdspollwaitq to decide whether anyone needs waking. atomicinc() carries no ordering and waitqueueactive() is a plain load, so nothing orders the map and generation stores before the wait queue reads. The waiters do the mirror image: rdscongwait() adds itself to mwaitq and then tests the port bit, and rdspoll() registers on rdspollwaitq and then reads the generation. That is the store-buffering pattern described above waitqueueactive() in include/linux/wait.h - the updater can observe an empty wait queue while the waiter still observes the port as congested, and no wake-up is issued.

rdscongwait() is an interruptible sleep with no timeout, so a sender blocked on a congested port stays blocked until the next congestion update from that peer arrives or a signal is delivered. A poll() waiter misses the map-updated notification the same way.

Use wqhassleeper(), which is waitqueueactive() preceded by the required full barrier, as rdstcpstatechange() already does for the same pattern.