If crypto_unregister_alg() is called with an algorithm that still has a
pending test larval, the algorithm will have a reference count of 2 and
crypto_unregister_alg() will trigger a BUG(). This can happen during
cleanup if the error path is taken for a built-in algorithm, before
crypto_algapi_init() was called.
Kill test larvals for untested algorithms during removal to fix the
reference count.
Fixes: adad556efcdd ("crypto: api - Fix built-in testing dependency failures")
Signed-off-by: Philipp Zabel <p.zabel@xxxxxxxxxxxxxx>
---
crypto/algapi.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
diff --git a/crypto/algapi.c b/crypto/algapi.c
index a366cb3e8aa1..fc3b75e59d0e 100644
--- a/crypto/algapi.c
+++ b/crypto/algapi.c
@@ -458,6 +458,28 @@ void crypto_unregister_alg(struct crypto_alg *alg)
if (WARN(ret, "Algorithm %s is not registered", alg->cra_driver_name))
return;
+ /* If there is a test larval holding a reference, remove it */
+ if (!(alg->cra_flags & CRYPTO_ALG_TESTED)) {
+ struct crypto_alg *q, *n;
+
+ list_for_each_entry_safe(q, n, &crypto_alg_list, cra_list) {
+ struct crypto_larval *l;
+
+ if (!crypto_is_larval(q))
+ continue;
+
+ l = (void *)q;
+
+ if (!crypto_is_test_larval(l))
+ continue;
+
+ if (l->adult != alg)
+ continue;
+
+ crypto_larval_kill(q);
+ }
+ }
+
BUG_ON(refcount_read(&alg->cra_refcnt) != 1);
if (alg->cra_destroy)
alg->cra_destroy(alg);
base-commit: e783362eb54cd99b2cac8b3a9aeac942e6f6ac07
--
2.30.2
