[PATCH] net: dsa: tag_rtl8_4: push VLAN tag into payload before DSA CPU tag

When a socket buffer has a hardware-accelerated VLAN tag (skb->vlan_tci
set), the upstream NIC (e.g. imx-dwmac with tx-vlan-offload fixed:on)
inserts the 802.1Q header after the DSA CPU tag, producing:

  [8100 VID][8899 CPU tag]

on the wire instead of the correct ordering:

  [8899 CPU tag][8100 VID]

The switch reads 0x8100 as the EtherType, does not recognise a valid
CPU tag, and fails to strip it on egress. The raw 0x8899 tag then leaks
to the peer port, breaking any protocol (e.g. batman-adv over a VLAN
subinterface) that relies on seeing clean 802.1Q frames.

Fix this by calling __vlan_hwaccel_push_inside() to move the VLAN tag
into the skb payload before prepending the RTL8_4 DSA CPU tag in
rtl8_4_tag_xmit(). The helper frees the skb internally on allocation
failure, so returning NULL directly is correct and consistent with how
tag_sja1105.c handles the same pattern.

Signed-off-by: Amitesh Singh <redacted>
---
 net/dsa/tag_rtl8_4.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/net/dsa/tag_rtl8_4.c b/net/dsa/tag_rtl8_4.c
index 4da3beebef75..bc11ddc4e178 100644
--- a/net/dsa/tag_rtl8_4.c
+++ b/net/dsa/tag_rtl8_4.c

@@ -128,6 +128,19 @@ static void rtl8_4_write_tag(struct sk_buff *skb, struct net_device *dev,
 static struct sk_buff *rtl8_4_tag_xmit(struct sk_buff *skb,
 				       struct net_device *dev)
 {
+	/* If the skb has a hardware-accelerated VLAN tag (skb->vlan_tci set),
+	 * push it into the payload before prepending the DSA CPU tag.
+	 * Otherwise the upstream NIC (e.g. imx-dwmac with tx-vlan-offload
+	 * fixed:on) will insert the 802.1Q header *after* the CPU tag,
+	 * producing [8100 VID][8899 CPU tag] on the wire instead of the
+	 * correct [8899 CPU tag][8100 VID].
+	 */
+	if (skb_vlan_tag_present(skb)) {
+		skb = __vlan_hwaccel_push_inside(skb);
+		if (!skb)
+			return NULL;
+	}
+
 	skb_push(skb, RTL8_4_TAG_LEN);
 
 	dsa_alloc_etype_header(skb, RTL8_4_TAG_LEN);

-- 
2.43.0