From 9f874ad0928500b205e5fc59b688695d2b1787ef Mon Sep 17 00:00:00 2001 From: Rob Norris Date: Tue, 17 Feb 2026 18:46:02 +1100 Subject: [PATCH] zdb: don't try to load key for unencrypted dataset Previously using -K/--key on an unencrypted dataset would trip a VERIFY, because the dataset has nowhere to load the key into. Now, just ignore it. This makes zdb much easier to drive when there's a mix of encrypt and non-encrypted datasets, as the key can provided for all of them (at least, assuming the same encryption root, which is a common enough case). Sponsored-by: TrueNAS Reviewed-by: Brian Behlendorf Reviewed-by: Alexander Motin Signed-off-by: Rob Norris Closes #18230 --- cmd/zdb/zdb.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/cmd/zdb/zdb.c b/cmd/zdb/zdb.c index f4ecba2e5..98ee4fbfb 100644 --- a/cmd/zdb/zdb.c +++ b/cmd/zdb/zdb.c @@ -3481,15 +3481,26 @@ open_objset(const char *path, const void *tag, objset_t **osp) path, strerror(err)); return (err); } - dsl_dataset_long_hold(dmu_objset_ds(*osp), tag); - dsl_pool_rele(dmu_objset_pool(*osp), tag); - /* succeeds or dies */ - zdb_load_key(*osp); + /* + * Only try to load the key and unlock the dataset if it is + * actually encrypted; otherwise we'll just crash. Just + * ignore the -K switch entirely otherwise; it's useful to be + * able to provide even if it's not needed. + */ + if ((*osp)->os_encrypted) { + dsl_dataset_long_hold(dmu_objset_ds(*osp), tag); + dsl_pool_rele(dmu_objset_pool(*osp), tag); - /* release it all */ - dsl_dataset_long_rele(dmu_objset_ds(*osp), tag); - dsl_dataset_rele(dmu_objset_ds(*osp), tag); + /* succeeds or dies */ + zdb_load_key(*osp); + + /* release it all */ + dsl_dataset_long_rele(dmu_objset_ds(*osp), tag); + dsl_dataset_rele(dmu_objset_ds(*osp), tag); + } else { + dmu_objset_rele(*osp, tag); + } } int ds_hold_flags = key_loaded ? DS_HOLD_FLAG_DECRYPT : 0;