--- a/usr/src/uts/common/fs/zfs/zio.c	Thu Nov 06 11:13:07 2008 +0000
+++ b/usr/src/uts/common/fs/zfs/zio.c	Thu Nov 06 16:07:49 2008 +0000
@@ -947,15 +947,22 @@
 		}
 	}
 
-	if (crypt == ZIO_CRYPT_INHERIT) {
-		crypt = BP_GET_CRYPT(bp);
+	if (!IO_IS_ALLOCATING(zio)){
+		/*
+		 * This is an already allocated block comming in via
+		 * rewrite so it is what is in the bp that matters
+		 * and io_prop will likeley be all zeros (inherit).
+		 */
+		if (crypt == ZIO_CRYPT_INHERIT) {
+			crypt = BP_GET_CRYPT(bp);
+		}
+		if (type == DMU_OT_NONE) {
+			type = BP_GET_TYPE(bp);
+		}
 	}
 
-	if (!IO_IS_ALLOCATING(zio) && type == DMU_OT_NONE) {
-		type = BP_GET_TYPE(bp);
-	}
-
-	if (crypt != ZIO_CRYPT_OFF &&
+	if ((IO_IS_ALLOCATING(zio) || type == DMU_OT_INTENT_LOG) &&
+	    crypt != ZIO_CRYPT_OFF &&
 	    spa_version(zio->io_spa) >= SPA_VERSION_CRYPTO) {
 		int crypt_error;
 
@@ -987,8 +994,10 @@
 			zio->io_error = crypt_error;
 			return (ZIO_PIPELINE_CONTINUE);
 		}
-
-		if (type == DMU_OT_INTENT_LOG) {
+		
+		if (mac == NULL) {
+			crypt = ZIO_CRYPT_OFF;
+		} else if (type == DMU_OT_INTENT_LOG) {
 			zil_trailer_t *ztp;
 			BP_SET_CRYPT(bp, crypt);
 			/*
@@ -1004,16 +1013,16 @@
 		} else {
 			maclen = zio_crypt_table[crypt].ci_maclen;
 			checksum = ZIO_CHECKSUM_SHA256_CCM_MAC;
+			/*
+			 * Note don't free the mac here it is put in
+			 * place again later and freed then.
+			 */
+			bp->blk_cksum.zc_word[2] = BE_64(mac[0]);
+			bp->blk_cksum.zc_word[3] = BE_64(mac[1]);
 		}
 		zio_push_transform(zio, encbuf, zio->io_size, encbufsize, NULL);
 	}
 
-	if (!IO_IS_ALLOCATING(zio)) {
-		/* Must have dealt with the crypto mac if there was one */
-		ASSERT(mac == NULL);
-		return (ZIO_PIPELINE_CONTINUE);
-	}
-
 	/*
 	 * If we aren't encrypting make sure the checksum isn't the
 	 * truncated SHA256+MAC variant - force to SHA256 instead.
@@ -1024,6 +1033,13 @@
 		checksum = ZIO_CHECKSUM_SHA256;
 	}
 
+	if (!IO_IS_ALLOCATING(zio)) {
+		/* Must have dealt with the crypto mac if there was one */
+		ASSERT(mac == NULL);
+		return (ZIO_PIPELINE_CONTINUE);
+	}
+
+
 	ASSERT(checksum != ZIO_CHECKSUM_INHERIT);
 	ASSERT(compress != ZIO_COMPRESS_INHERIT);
 	if (spa_version(zio->io_spa) >= SPA_VERSION_CRYPTO) {
@@ -1051,6 +1067,7 @@
 
 	if (csize == 0) {
 		zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;
+		ASSERT(mac == NULL);
 	} else {
 		ASSERT(checksum != ZIO_CHECKSUM_GANG_HEADER);
 		BP_SET_LSIZE(bp, lsize);
@@ -1073,6 +1090,8 @@
 			 * of a different size this needs updating.
 			 */
 			ASSERT(maclen == 16);
+			ASSERT(mac[0] != 0);
+			ASSERT(mac[1] != 0);
 			ASSERT3U(crypt, >, ZIO_CRYPT_INHERIT);
 			ASSERT3U(crypt, <=, ZIO_CRYPT_FUNCTIONS);
 			ASSERT3U(crypt, !=, ZIO_CRYPT_OFF);
@@ -1089,6 +1108,8 @@
 
 	}
 
+	ASSERT(mac == NULL);
+
 	return (ZIO_PIPELINE_CONTINUE);
 }
 

--- a/usr/src/uts/common/fs/zfs/zio_crypt.c	Thu Nov 06 11:13:07 2008 +0000
+++ b/usr/src/uts/common/fs/zfs/zio_crypt.c	Thu Nov 06 16:07:49 2008 +0000
@@ -2012,12 +2012,15 @@
 			    &srciov, &dstiov, &plaintext.cd_length);
 			if (iovcnt == 0) {
 				zio_crypt_key_release(key, FTAG);
+				kmem_free(mac, maclen);
+				*macp = NULL;
 				return (0);
 			}
 		} else if (type == DMU_OT_INTENT_LOG) {
 			iovcnt = zil_setup_crypto_data(src, srcsize, dest,
 			    &srciov, &dstiov, &plaintext.cd_length);
 			ASSERT3U(maclen, ==, ZIL_CCM_MAC_LEN);
+			ASSERT(iovcnt != 0);
 		}
 		srcuio.uio_iov = srciov;
 		srcuio.uio_iovcnt = iovcnt;
@@ -2188,6 +2191,7 @@
 			iovcnt = zil_setup_crypto_data(src, srcsize, dest,
 			    &srciov, &dstiov, &plaintext.cd_length);
 			ASSERT3U(maclen, ==, ZIL_CCM_MAC_LEN);
+			ASSERT(iovcnt != 0);
 		}
 		dstuio.uio_iovcnt = iovcnt;
 		dstuio.uio_iov = dstiov;