in function llc_sap_state_proces there was lack of return statement,
and finalizing kfree_skb might be called after skb was already freed
or queued to the user.

following patch adds the necessary return.

---

--- a/net/llc/llc_sap.c 2008-05-27 12:52:01.000000000 +0600
+++ b/net/llc/llc_sap.c 2008-05-27 12:52:37.000000000 +0600

@@ -223,6 +223,7 @@
                        if (sock_queue_rcv_skb(skb->sk, skb))
                                kfree_skb(skb);
                }
+               return;
        }
        kfree_skb(skb);
 }