[IPCOMP]: Set x->km.state to XFRM_STATE_DEAD in ipcomp_tunnel_create().

Otherwise we can trigger the BUG trap in __xfrm_state_destroy() when
xfrm_state_put() finds this is the last reference.

net/ipv4/ipcomp.c

@@ -294,6 +294,7 @@ static struct xfrm_state *ipcomp_tunnel_create(struct xfrm_state *x)
 	return t;
 
 error:
+	t->km.state = XFRM_STATE_DEAD;
 	xfrm_state_put(t);
 	t = NULL;
 	goto out;