Ensure dsl_destroy_head() decrypts objsets

This patch corrects a small issue where the dsl_destroy_head()
code that runs when the async_destroy feature is disabled would
not properly decrypt the dataset before beginning processing.
If the dataset is not able to be decrypted, the optimization
code now simply does not run and the dataset is completely
destroyed in the DSL sync task.

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Signed-off-by: Tom Caputi <tcaputi@datto.com>
Closes openzfs#9021

module/zfs/dsl_destroy.c

@@ -1059,9 +1059,10 @@ dsl_destroy_head(const char *name)
 		/*
 		 * Head deletion is processed in one txg on old pools;
 		 * remove the objects from open context so that the txg sync
-		 * is not too long.
+		 * is not too long. This optimization can only work for
+		 * encrypted datasets if the wrapping key is loaded.
 		 */
-		error = dmu_objset_own(name, DMU_OST_ANY, B_FALSE, B_FALSE,
+		error = dmu_objset_own(name, DMU_OST_ANY, B_FALSE, B_TRUE,
 		    FTAG, &os);
 		if (error == 0) {
 			uint64_t prev_snap_txg =
@@ -1073,7 +1074,7 @@ dsl_destroy_head(const char *name)
 				(void) dmu_free_long_object(os, obj);
 			/* sync out all frees */
 			txg_wait_synced(dmu_objset_pool(os), 0);
-			dmu_objset_disown(os, B_FALSE, FTAG);
+			dmu_objset_disown(os, B_TRUE, FTAG);
 		}
 	}