Comment # 3 on bug 1018515 from Martin Wilck

The bug is here:

    BUG_ON(atomic_read(&alg->cra_refcnt) != 1);

The cra_refcnt appears to be 2 (%rax) in the stack trace above.
I've tried to follow the refcounting in the code but haven't found the problem
yet.