QEMU 9pfs race fixed by confining FID path updates to main thread

QEMU has fixed CVE-2026-93834 in its 9p filesystem code, closing a race in how file identifier (FID) paths were updated during open.

The flaw sat in the coroutine path used for open: it was the only place that rewrote a FID path from a worker thread while holding the path write lock. Everywhere else, FID path changes run on the main thread. Main-thread readers such as walk, xattr walk, and stat therefore treated path access as single-threaded and skipped the path read lock. A concurrent open could free and replace the path under them, leaving those readers with an inconsistent or freed path.

Christian Schoenebeck changed the open path so the worker only builds the new path in a local variable. The actual assignment to the FID happens after control returns to the main thread, still under the write lock, matching the rest of the 9p code. Milad Nasr reported the issue and suggested the approach; Greg Kurz reviewed the change.

Hosts that expose guest filesystem access through 9p are the affected configuration. The fix removes the cross-thread mutation that made the lock scheme incomplete.