CVE-2026-74306: vfio/qat: fix f_pos race in qat_vf_resume_write()

In the Linux kernel, the following vulnerability has been resolved:

vfio/qat: fix fpos race in qatvfresumewrite()

qatvfresumewrite() checks filp->fpos before taking migf->lock, but copies into the migration-state buffer after taking the lock and re-reading the shared file position.

Two concurrent writers could therefore pass the bounds check with the old offset, then have the second writer copy after the first advanced fpos, writing past the end of the migration-state buffer.

Take migf->lock before doing the boundary checks.