When the SDRAM is configured, its base address is determined by the BMAP bits of the FMC_BCR1 register. See the FMC bank mapping options table in the External device address mapping section of the reference manual.
Check the linker definition file (linker script/scatter file/whatever the documentation of your toolchain calls it) of your project. If the SDRAM address range is already known to the linker, you can allocate an array for the framebuffer there. Consult the documentation of your compiler and linker on how to do this.
If the linker doesn't know about the SDRAM, you can pick its base address, or any area that isn't used elsewhere in your project, as the address of the framebuffer.
Write the address oif the framebuffer into the LTDC_Layer1->CFBAR register before finalizing the LTDC configuration by setting the VBR or IMR bit in LTDC->SRCR.
