diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
index 6d5cc0217133e030a8b6cde13921933d4d0b1b9d..da18094b5a049b0e5e77c74c881cc15aa2ffe206 100644
--- a/net/dsa/dsa2.c
+++ b/net/dsa/dsa2.c
@@ -811,7 +811,9 @@ static int dsa_switch_setup_tag_protocol(struct dsa_switch *ds)
 		if (!dsa_is_cpu_port(ds, port))
 			continue;
 
+		rtnl_lock();
 		err = ds->ops->change_tag_protocol(ds, port, tag_ops->proto);
+		rtnl_unlock();
 		if (err) {
 			dev_err(ds->dev, "Unable to use tag protocol \"%s\": %pe\n",
 				tag_ops->name, ERR_PTR(err));