[XFRM_USER]: xfrm_state_construct() needs to set x->km.state to XFRM_STATE_DEAD.

Otherwise this can lead to the BUG_TRAP in __xfrm_state_destroy when
xfrm_state_put() finds this is the last reference.

net/xfrm/xfrm_user.c

@@ -241,6 +241,7 @@ static struct xfrm_state *xfrm_state_construct(struct xfrm_usersa_info *p,
 	return x;
 
 error:
+	x->km.state = XFRM_STATE_DEAD;
 	xfrm_state_put(x);
 error_no_put:
 	*errp = err;