bdrv_is_encrypted() should not only check the BDS's backing child, but any filtered child: If a filter's child is encrypted, the filter node itself naturally is encrypted, too. Furthermore, we need to recurse down the chain.
(CAF means child access function.) Signed-off-by: Max Reitz <mre...@redhat.com> --- block.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/block.c b/block.c index 45882a3470..567a0f82c8 100644 --- a/block.c +++ b/block.c @@ -4574,10 +4574,14 @@ bool bdrv_is_sg(BlockDriverState *bs) bool bdrv_is_encrypted(BlockDriverState *bs) { - if (bs->backing && bs->backing->bs->encrypted) { + BlockDriverState *filtered = bdrv_filtered_bs(bs); + if (bs->encrypted) { return true; } - return bs->encrypted; + if (filtered && bdrv_is_encrypted(filtered)) { + return true; + } + return false; } const char *bdrv_get_format_name(BlockDriverState *bs) -- 2.21.0