I ran several times into a kernel oops caused by a NULL pointer dereference
in nouveau_fence_sync(). The variable "prev" may be non-NULL while
"prev->cli" is NULL, leading to an unconditional dereference of
"prev->cli->drm".

Prevent the dereference by checking "prev->cli" before accessing
its "drm" field while preserving the existing logic.

Fixes: 1f9910b41c857 ("nouveau/fence: handle cross device fences properly")
Signed-off-by: Emmanuel Fleury <emmanuel.fleury@u-bordeaux.fr>
---
  drivers/gpu/drm/nouveau/nouveau_fence.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.c 
b/drivers/gpu/drm/nouveau/nouveau_fence.c
index edbe9e08ba0f..90e6e89c0911 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fence.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fence.c
@@ -374,7 +374,7 @@ nouveau_fence_sync(struct nouveau_bo *nvbo, struct 
nouveau_channel *chan,

  				rcu_read_lock();
  				prev = rcu_dereference(f->channel);
-				local = prev && prev->cli->drm == chan->cli->drm;
+				local = prev && prev->cli && prev->cli->drm == chan->cli->drm;
  				if (local && (prev == chan ||
  					      fctx->sync(f, prev, chan) == 0))
  					must_wait = false;
-- 
2.53.0