kernel module's reference count - linux-kernel

Question

I have a module to maintain, and it appears it has issues with reference counter being kept in the kernel, which results in that I'm unable to rmmod my module, after I kill the daemon opening 3 raw sockets to the module. Interestingly, after loading the daemon 'lsmod' displays 6 references to the module exist, I'd expect only three.
This is occuring on ARM-based embedded system with Linux-2.6.31, and rmmod doesn't have 'force' mode to try enforce unload a module (it's anyway not good idea).
I've analyzed the code and here is what I have:
1) The module creates new socket address family AF_HSL and registers with the kernel:
static struct proto_ops SOCKOPS_WRAPPED (hsl_ops) = {
family: AF_HSL,
owner: THIS_MODULE,
release: hsl_sock_release,
bind: _hsl_sock_bind,
connect: sock_no_connect,
socketpair: sock_no_socketpair,
accept: sock_no_accept,
getname: _hsl_sock_getname,
poll: datagram_poll,
ioctl: sock_no_ioctl,
listen: sock_no_listen,
shutdown: sock_no_shutdown,
setsockopt: sock_no_setsockopt,
getsockopt: sock_no_getsockopt,
sendmsg: _hsl_sock_sendmsg,
recvmsg: _hsl_sock_recvmsg,
mmap: sock_no_mmap,
sendpage: sock_no_sendpage,
};
static struct net_proto_family hsl_family_ops = {
family: AF_HSL,
create: _hsl_sock_create,
owner: THIS_MODULE
};
...
static int
_hsl_sock_create (struct net *net, struct socket *sock, int protocol)
{
struct sock *sk = NULL;
sock->state = SS_UNCONNECTED;
sk = sk_alloc (current->nsproxy->net_ns, AF_HSL, GFP_KERNEL, &_prot);
if (sk == NULL)
goto ERR;
sock->ops = &SOCKOPS_WRAPPED(hsl_ops);
sock_init_data (sock,sk);
sock_hold (sk); /* XXX */
...
}
static void
_hsl_sock_destruct (struct sock *sk)
{
struct hsl_sock *hsk, *phsk;
if (!sk)
return;
...
sock_orphan (sk);
skb_queue_purge (&sk->sk_receive_queue);
sock_put (sk);
}
int
hsl_sock_release (struct socket *sock)
{
struct sock *sk = sock->sk;
/* Here goes logic to destroy net_devices */
...
_hsl_sock_destruct (sk);
sock->sk = NULL;
return 0;
}
2) the daemon creates sockets in such way
fd = socket(AF_HSL, SOCK_RAW, 0);;
bind();
getsockname();
However I don't think _hsl_sock_create() should be calling sock_hold(), that would bump socket's reference count, but it's already set to 1 by sock_init_data(), and at socket delete phase sock_put() would decrement by 1, however this would not have the socket free;d and completely removed from the system.
So I experimented and removed sock_hold(); Now killing daemon yields in all references removed and 'rmmod' succedes, however the number of references after starting daemon is still 3.
I also have checked code at socket_create() whick calls internal function __socket_create(), which in turn calls try_module_get() and holds module's reference count. This appears to be the only place I've found that explicitly increments the module's refcnt.
I am still confused. Would anyone try to help understand what is happening?
Looking forward to hearing from you.
Mark