Re: [PATCH v4 7/7] qemu-img: Deprecate use of -b without -F

Creating an image that requires format probing of the backing image is inherently unsafe (we've had several CVEs over the years based on probes leaking information to the guest on a subsequent boot, although these days tools like libvirt are aware of the issue enough to prevent the worst effects). However, if our probing algorithm ever changes, or if other tools like libvirt determine a different probe result than we do, then subsequent use of that backing file under a different format will present corrupted data to the guest. Start a deprecation clock so that future qemu-img can refuse to create unsafe backing chains that would rely on probing. The warnings are intentionally emitted from the block layer rather than qemu-img (thus, all paths into image creation or rewriting perform the check). However, there is one time where probing is safe: if we probe raw, then it is safe to record that implicitly in the image (but we still warn, as it's better to teach the user to supply -F always than to make them guess when it is safe). iotest 114 specifically wants to create an unsafe image for later amendment rather than defaulting to our new default of recording a probed format, so it needs an update. While touching it, expand it to cover all of the various warnings enabled by this patch. iotest 290 also shows a change to qcow messages; note that the fact that we now make a probed format of 'raw' explicit now results in a double warning, but no one should be creating new qcow images so it is not worth cleaning up. Signed-off-by: Eric Blake <eblake(a)redhat.com&gt; --- docs/system/deprecated.rst | 19 +++++++++++++++++++ block.c | 21 ++++++++++++++++++++- qemu-img.c | 2 +- tests/qemu-iotests/114 | 11 +++++++++++ tests/qemu-iotests/114.out | 8 ++++++++ tests/qemu-iotests/290.out | 5 ++++- 6 files changed, 63 insertions(+), 3 deletions(-)