From 15e37e09198b9aa30ede690cd68d4dae9871afa8 Mon Sep 17 00:00:00 2001 From: Alexander Motin Date: Thu, 12 Mar 2026 09:51:33 -0400 Subject: [PATCH] ZVOL: Add encryption key check for block cloning Somehow during block cloning porting from file systems was missed the check for identical encryption keys. As result, blocks cloned between unrelated ZVOLs produced authentication errors on later reads. Having same or different encryption root does not matter. This patch copies dmu_objset_crypto_key_equal() call from FS side. Reviewed-by: Ameer Hamza Reviewed-by: Brian Behlendorf Signed-off-by: Alexander Motin Closes #18315 --- module/zfs/zvol.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/module/zfs/zvol.c b/module/zfs/zvol.c index 407758641..15ee62ca5 100644 --- a/module/zfs/zvol.c +++ b/module/zfs/zvol.c @@ -663,10 +663,26 @@ zvol_clone_range(zvol_state_t *zv_src, uint64_t inoff, zvol_state_t *zv_dst, error = SET_ERROR(EXDEV); goto out; } + + /* + * Block cloning from an unencrypted dataset into an encrypted + * dataset and vice versa is not supported. + */ if (inos->os_encrypted != outos->os_encrypted) { error = SET_ERROR(EXDEV); goto out; } + + /* + * Cloning across encrypted datasets is possible only if they + * share the same master key. + */ + if (inos != outos && inos->os_encrypted && + !dmu_objset_crypto_key_equal(inos, outos)) { + error = SET_ERROR(EXDEV); + goto out; + } + if (zv_src->zv_volblocksize != zv_dst->zv_volblocksize) { error = SET_ERROR(EINVAL); goto out;