Fix block cloning between unencrypted and encrypted datasets

When copying data to or from an encrypted dataset, block cloning
should be used only when it is the same dataset. The current code
checked only if the source was encrypted and the check should
happen more early to avoid unnecessary operations.

We may relax this condition in the future by supporting block cloning
between encrypted datasets using the same key.

Fixes openzfs#15464

Signed-off-by:  Martin Matuska <mm@FreeBSD.org>

module/zfs/zfs_vnops.c

@@ -1094,6 +1094,17 @@ zfs_clone_range(znode_t *inzp, uint64_t *inoffp, znode_t *outzp,
 
 	ASSERT(!outzfsvfs->z_replay);
 
+	/*
+	 * If source and destination are not the same filesystem
+	 * neither may be encrypted.
+	 * TODO: Support of cloning encrypted datasets with identical keys
+	 */
+	if (inzfsvfs != outzfsvfs &&
+	    (inos->os_encrypted || outos->os_encrypted)) {
+		zfs_exit_two(inzfsvfs, outzfsvfs, FTAG);
+		return (SET_ERROR(EXDEV));
+	}
+
 	error = zfs_verify_zp(inzp);
 	if (error == 0)
 		error = zfs_verify_zp(outzp);