drm/virtio: Fix NULL pointer deref in virtgpu_dma_buf_free_obj()

There is a chance that obj->dma_buf would be NULL by the time
virtgpu_dma_buf_free_obj() is called. This can happen for imported
prime objects, when drm_gem_object_exported_dma_buf_free() gets
called on them before drm_gem_object_free(). This is because
drm_gem_object_exported_dma_buf_free() explicitly sets
obj->dma_buf to NULL.

Therefore, fix this issue by storing the dma_buf pointer in the
virtio_gpu_object instance and using it in virtgpu_dma_buf_free_obj.
This stored pointer is guaranteed to be valid until the object is
freed as we took a reference on it in virtgpu_gem_prime_import().

Fixes: 415cb45895f4 ("drm/virtio: Use dma_buf from GEM object instance")
Cc: Dmitry Osipenko <[e-mail]>
Cc: Thomas Zimmermann <[e-mail]>
Signed-off-by: Vivek Kasireddy <[e-mail]>
Reviewed-by: Dmitry Osipenko <[e-mail]>
Signed-off-by: Dmitry Osipenko <[e-mail]>
Link: https://lore.kernel.org/r/[e-mail]

drivers/gpu/drm/virtio/virtgpu_drv.h

···
 
 struct virtio_gpu_object {
 	struct drm_gem_shmem_object base;
+	struct dma_buf *dma_buf;
 	struct sg_table *sgt;
 	uint32_t hw_res_handle;
 	bool dumb;

drivers/gpu/drm/virtio/virtgpu_prime.c

···
 	struct virtio_gpu_device *vgdev = obj->dev->dev_private;
 
 	if (drm_gem_is_imported(obj)) {
-		struct dma_buf *dmabuf = obj->dma_buf;
+		struct dma_buf *dmabuf = bo->dma_buf;
 
 		dma_resv_lock(dmabuf->resv, NULL);
 		virtgpu_dma_buf_unmap(bo);
···
 
 	obj->import_attach = attach;
 	get_dma_buf(buf);
+	bo->dma_buf = buf;
 
 	ret = virtgpu_dma_buf_init_obj(dev, bo, attach);
 	if (ret < 0)