net:wireless: call cfg80211_leave_ocb when switching between ADHOC and OCB

If the userland switches back-and-forth between NL80211_IFTYPE_OCB and NL80211_IFTYPE_ADHOC via send_msg(NL80211_CMD_SET_INTERFACE), there is a chance where the cleanup cfg80211_leave_ocb() is not called. This leads to initialization of in-use memory (e.g. init u.ibss while in-use by u.ocb) due to a shared struct/union within ieee80211_sub_if_data:

struct ieee80211_sub_if_data {
    ...
    union {
        struct ieee80211_if_ap ap;
        struct ieee80211_if_vlan vlan;
        struct ieee80211_if_managed mgd;
        struct ieee80211_if_ibss ibss; // <- shares address
        struct ieee80211_if_mesh mesh;
        struct ieee80211_if_ocb ocb; // <- shares address
        struct ieee80211_if_mntr mntr;
        struct ieee80211_if_nan nan;
    } u;
    ...
}

Therefore add handling of otype == NL80211_IFTYPE_OCB, during cfg80211_change_iface() to perform cleanup when leaving OCB mode.

link to syzkaller bug:
https://syzkaller.appspot.com/bug?id=0612dbfa595bf4b9b680ff7b4948257b8e3732d5

---
Reproducible steps:

1. NL80211_CMD_SET_INTERFACE: NL80211_IFTYPE_ADHOC // set IBSS mode

2. NL80211_CMD_SET_INTERFACE: NL80211_IFTYPE_OCB
// switch to OCB mode, calls ieee80211_ocb_setup_sdata, init u.ocb.housekeeping_timer

3. NL80211_CMD_JOIN_OCB

4. NL80211_CMD_SET_INTERFACE: NL80211_IFTYPE_ADHOC // swtich to IBSS mode without calling NL80211_CMD_LEAVE_OCB, // leaving u.ocb.housekeeping_timer NOT destroyed

5. entering IBSS mode, kernel panic while initializing u.ibss.timer, an active debug_object as &u.ibss.timer == &u.ocb.housekeeping_timer

 net/wireless/util.c | 3 +++
 1 file changed, 3 insertions(+)

index 1bf0200f562a..f424ac7633bb 100644
@@ -1056,6 +1056,9 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
 		case NL80211_IFTYPE_MESH_POINT:
 			/* mesh should be handled? */
 			break;
+		case NL80211_IFTYPE_OCB:
+			cfg80211_leave_ocb(rdev, dev);
+			break;
 		default:
 			break;
 		}

2.30.2