llc use-after-free

My test box running rc5-mm1 was kinda sitting there doing nothing when it
decided to have an oops in the llc code.  See

http://www.zip.com.au/~akpm/linux/patches/stuff/dsc03542.jpg

gdb says:



0x197 is in llc_rcv (net/llc/llc_input.c:68).
63      static __inline__ int llc_pdu_type(struct sk_buff *skb)
64      {
65              int type = LLC_DEST_CONN; /* I-PDU or S-PDU type */
66              struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
67      
68              if ((pdu->ctrl_1 & LLC_PDU_TYPE_MASK) != LLC_PDU_TYPE_U)
69                      goto out;
70              switch (LLC_U_PDU_CMD(pdu)) {
71              case LLC_1_PDU_CMD_XID:
72              case LLC_1_PDU_CMD_UI: