>- iph->saddr = dev->pa_addr;
>+ iph->saddr = tdev->pa_addr;
It was deliberate breaking. The problem was that tdev jumps,
when real route to peer changes. tunnel->pa_addr
could be set equal to tdev->pa_addr, if you believe that
route is static. Particularly, it means that the host with tunnel
cannot talk over tunnel itself. Apparently, it was wrong,
but it was the best workaround using only pa_* addresses.
>+ MOD_INC_USE_COUNT;
It is redundant. MOD_*_USE_COUNT in open and close are enough.
>- dev = ip_dev_find_tunnel(iph->daddr, iph->saddr);
>+ dev = ip_dev_find_tunnel(skb->nh.iph->daddr, iph->saddr);
It is wrong. skb->nh.iph->daddr has nothing to do with tunnel.
It is destination address of initial packet, that can be everywhere
on the Internet.
If you changed in tunnel.c dev to tdev, just delete ip_dev_find_tunnel
and use skb->dev instead.
Alexey Kuznetsov.