Bug 1494454

While looking at the code, we already report error:

static bool
qemuMigrationSrcIsSafe(virDomainDefPtr def,
                       size_t nmigrate_disks,
                       const char **migrate_disks,
                       unsigned int flags)

{
    bool storagemigration = flags & (VIR_MIGRATE_NON_SHARED_DISK |
                                     VIR_MIGRATE_NON_SHARED_INC);
    size_t i;
    int rc;

    for (i = 0; i < def->ndisks; i++) {
        virDomainDiskDefPtr disk = def->disks[i];
        const char *src = virDomainDiskGetSource(disk);

        /* Our code elsewhere guarantees shared disks are either readonly (in
         * which case cache mode doesn't matter) or used with cache=none or used with cache=directsync */
        if (virStorageSourceIsEmpty(disk->src) ||
            disk->src->readonly ||
            disk->src->shared ||
            disk->cachemode == VIR_DOMAIN_DISK_CACHE_DISABLE ||
            disk->cachemode == VIR_DOMAIN_DISK_CACHE_DIRECTSYNC)
            continue;

        /* disks which are migrated by qemu are safe too */
        if (storagemigration &&
            qemuMigrationAnyCopyDisk(disk, nmigrate_disks, migrate_disks))
            continue;

        if (virDomainDiskGetType(disk) == VIR_STORAGE_TYPE_FILE) {
            if ((rc = virFileIsSharedFS(src)) < 0)
                return false;
            else if (rc == 0)
                continue;
            if ((rc = virStorageFileIsClusterFS(src)) < 0)
                return false;
            else if (rc == 1)
                continue;
        } else if (disk->src->type == VIR_STORAGE_TYPE_NETWORK &&
                   disk->src->protocol == VIR_STORAGE_NET_PROTOCOL_RBD) {
            continue;
        }

        virReportError(VIR_ERR_MIGRATE_UNSAFE, "%s",
                       _("Migration may lead to data corruption if disks"
                         " use cache != none or cache != directsync"));
        return false;
    }

    return true;
}


Of course this can be overridden by --unsafe flag. Isn't this enough?

Ah, that's more than I thought we did, but there's a couple of issues there 

 - If virFileIsSharedFS() returns 0 (ie a local ext3 FS), then we jump to next loop iteration. We should check if block migration is requested here, and raise error if it is not.  

 - If the disk is marked <shareable/> then we don't even bother with the IsSharedFS() check, which is again a problem if that detects a local FS with no block migration eanbled.

Okay, patch posted upstream:

https://www.redhat.com/archives/libvir-list/2018-February/msg01154.html

I've just pushed the patch upstream:

commit ed11e9cd95bd9cae6cdfab14ae0936930bbb63e6
Author:     Michal Privoznik <mprivozn>
AuthorDate: Mon Feb 26 09:35:25 2018 +0100
Commit:     Michal Privoznik <mprivozn>
CommitDate: Mon Feb 26 11:32:05 2018 +0100

    qemuMigrationSrcIsSafe: Check local storage more thoroughly
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1494454
    
    If a domain disk is stored on local filesystem (e.g. ext4) but is
    not being migrated it is very likely that domain is not able to
    run on destination. Regardless of share/cache mode.
    
    Signed-off-by: Michal Privoznik <mprivozn>
    Reviewed-by: Daniel P. Berrangé <berrange>

v4.1.0-rc1-1-ged11e9cd9

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2018:3113