From 05f8be3b49df5622b590d17ae328c886b7a1212e Mon Sep 17 00:00:00 2001
From: Christian Schwarz <me@cschwarz.com>
Date: Wed, 14 Oct 2020 23:04:19 +0200
Subject: [PATCH] Fix crash caused by invalid snapshot names in redactnvl

This is a follow up fix for commit 0fdd6106bb.  The VERIFY is
only true when we haven't hit an error code path.  See added
test case for a reproducer.

Reviewed-by: Matthew Ahrens <mahrens@delphix.com>
Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Signed-off-by: Christian Schwarz <me@cschwarz.com>
Closes #11048
---
 module/zfs/dmu_redact.c                                         | 2 +-
 .../tests/functional/redacted_send/redacted_negative.ksh        | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/module/zfs/dmu_redact.c b/module/zfs/dmu_redact.c
index c53fba75cc..225ec40537 100644
--- a/module/zfs/dmu_redact.c
+++ b/module/zfs/dmu_redact.c
@@ -1062,9 +1062,9 @@ dmu_redact_snap(const char *snapname, nvlist_t *redactnvl,
 
 		}
 	}
-	VERIFY3P(nvlist_next_nvpair(redactnvl, pair), ==, NULL);
 	if (err != 0)
 		goto out;
+	VERIFY3P(nvlist_next_nvpair(redactnvl, pair), ==, NULL);
 
 	boolean_t resuming = B_FALSE;
 	zfs_bookmark_phys_t bookmark;
diff --git a/tests/zfs-tests/tests/functional/redacted_send/redacted_negative.ksh b/tests/zfs-tests/tests/functional/redacted_send/redacted_negative.ksh
index 56b990be1b..432460fa2f 100755
--- a/tests/zfs-tests/tests/functional/redacted_send/redacted_negative.ksh
+++ b/tests/zfs-tests/tests/functional/redacted_send/redacted_negative.ksh
@@ -56,6 +56,8 @@ done
 log_mustnot zfs redact $sendfs@snap1
 log_mustnot zfs redact $sendfs@snap1 book
 log_mustnot zfs redact $sendfs#book1 book4 $clone1
+log_mustnot zfs redact $sendfs@snap1 book snap2 snap3
+log_mustnot zfs redact $sendfs@snap1 book @snap2 @snap3
 log_mustnot eval "zfs send --redact $sendfs#book $sendfs@snap >/dev/null"
 
 # Redaction snapshots not a descendant of tosnap