vhost/crypto: fix possible TOCTOU attack