During driver unload, "mrioc->bsg_device" reference count becomes negative.
Also, as reported in [1], driver's bsg_device model had few more 
bugs so reworked it to fix up them.

[1] https://marc.info/?l=linux-scsi&m=165183971411991&w=2

Fixes: 4268fa751365 ("scsi: mpi3mr: Add bsg device support")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
---
 drivers/scsi/mpi3mr/mpi3mr.h     |  2 +-
 drivers/scsi/mpi3mr/mpi3mr_app.c | 48 +++++++++++++++-----------------
 2 files changed, 23 insertions(+), 27 deletions(-)

diff --git a/drivers/scsi/mpi3mr/mpi3mr.h b/drivers/scsi/mpi3mr/mpi3mr.h
index 01cd01787b0f..0e1cb4aa4ca2 100644
--- a/drivers/scsi/mpi3mr/mpi3mr.h
+++ b/drivers/scsi/mpi3mr/mpi3mr.h
@@ -954,7 +954,7 @@ struct mpi3mr_ioc {
 	u16 active_poll_qcount;
 	u16 requested_poll_qcount;
 
-	struct device *bsg_dev;
+	struct device bsg_dev;
 	struct request_queue *bsg_queue;
 	u8 stop_bsgs;
 	u8 *logdata_buf;
diff --git a/drivers/scsi/mpi3mr/mpi3mr_app.c b/drivers/scsi/mpi3mr/mpi3mr_app.c
index 9ab1762468ad..29ed64a572ea 100644
--- a/drivers/scsi/mpi3mr/mpi3mr_app.c
+++ b/drivers/scsi/mpi3mr/mpi3mr_app.c
@@ -1487,28 +1487,28 @@ static int mpi3mr_bsg_request(struct bsg_job *job)
  */
 void mpi3mr_bsg_exit(struct mpi3mr_ioc *mrioc)
 {
+	struct device *bsg_dev = &mrioc->bsg_dev;
 	if (!mrioc->bsg_queue)
 		return;
 
 	bsg_remove_queue(mrioc->bsg_queue);
 	mrioc->bsg_queue = NULL;
 
-	device_del(mrioc->bsg_dev);
-	put_device(mrioc->bsg_dev);
-	kfree(mrioc->bsg_dev);
+	device_del(bsg_dev);
+	put_device(bsg_dev);
 }
 
 /**
  * mpi3mr_bsg_node_release -release bsg device node
  * @dev: bsg device node
  *
- * decrements bsg dev reference count
+ * decrements bsg dev parent reference count
  *
  * Return:Nothing
  */
 static void mpi3mr_bsg_node_release(struct device *dev)
 {
-	put_device(dev);
+	put_device(dev->parent);
 }
 
 /**
@@ -1521,41 +1521,37 @@ static void mpi3mr_bsg_node_release(struct device *dev)
  */
 void mpi3mr_bsg_init(struct mpi3mr_ioc *mrioc)
 {
-	mrioc->bsg_dev = kzalloc(sizeof(struct device), GFP_KERNEL);
-	if (!mrioc->bsg_dev) {
-		ioc_err(mrioc, "bsg device mem allocation failed\n");
-		return;
-	}
+	struct device *bsg_dev = &mrioc->bsg_dev;
+	struct device *parent = &mrioc->shost->shost_gendev;
+
+	device_initialize(bsg_dev);
+
+	bsg_dev->parent = get_device(parent);
+	bsg_dev->release = mpi3mr_bsg_node_release;
 
-	device_initialize(mrioc->bsg_dev);
-	dev_set_name(mrioc->bsg_dev, "mpi3mrctl%u", mrioc->id);
+	dev_set_name(bsg_dev, "mpi3mrctl%u", mrioc->id);
 
-	if (device_add(mrioc->bsg_dev)) {
+	if (device_add(bsg_dev)) {
 		ioc_err(mrioc, "%s: bsg device add failed\n",
-		    dev_name(mrioc->bsg_dev));
-		goto err_device_add;
+		    dev_name(bsg_dev));
+		put_device(bsg_dev);
+		return;
 	}
 
-	mrioc->bsg_dev->release = mpi3mr_bsg_node_release;
-
-	mrioc->bsg_queue = bsg_setup_queue(mrioc->bsg_dev, dev_name(mrioc->bsg_dev),
+	mrioc->bsg_queue = bsg_setup_queue(bsg_dev, dev_name(bsg_dev),
 			mpi3mr_bsg_request, NULL, 0);
 	if (IS_ERR(mrioc->bsg_queue)) {
 		ioc_err(mrioc, "%s: bsg registration failed\n",
-		    dev_name(mrioc->bsg_dev));
-		goto err_setup_queue;
+		    dev_name(bsg_dev));
+		device_del(bsg_dev);
+		put_device(bsg_dev);
+		return;
 	}
 
 	blk_queue_max_segments(mrioc->bsg_queue, MPI3MR_MAX_APP_XFER_SEGMENTS);
 	blk_queue_max_hw_sectors(mrioc->bsg_queue, MPI3MR_MAX_APP_XFER_SECTORS);
 
 	return;
-
-err_setup_queue:
-	device_del(mrioc->bsg_dev);
-	put_device(mrioc->bsg_dev);
-err_device_add:
-	kfree(mrioc->bsg_dev);
 }
 
 /**
-- 
2.27.0