Check portable objset MAC even if local is zeroed

PR #14161 made spa_do_crypt_objset_mac_abd() to ignore MAC errors
if local MAC can not be calculated at the time.  But it does not
mean we should also ignore portable MAC errors there.

Reviewed-by: Tony Hutter <[email protected]>
Signed-off-by:	Alexander Motin <[email protected]>
Sponsored by:	iXsystems, Inc.
Closes #17122

Author: amotin

module/zfs/dsl_crypt.c

@@ -2738,8 +2738,11 @@ spa_do_crypt_objset_mac_abd(boolean_t generate, spa_t *spa, uint64_t dsobj,
 	}
 
 	if (memcmp(portable_mac, osp->os_portable_mac,
-	    ZIO_OBJSET_MAC_LEN) != 0 ||
-	    memcmp(local_mac, osp->os_local_mac, ZIO_OBJSET_MAC_LEN) != 0) {
+	    ZIO_OBJSET_MAC_LEN) != 0) {
+		abd_return_buf(abd, buf, datalen);
+		return (SET_ERROR(ECKSUM));
+	}
+	if (memcmp(local_mac, osp->os_local_mac, ZIO_OBJSET_MAC_LEN) != 0) {
 		/*
 		 * If the MAC is zeroed out, we failed to decrypt it.
 		 * This should only arise, at least on Linux,