Well, to be fair, the NULL check was in a wrong place. The pointer was already dereferenced before the check.
struct tun_struct *tun = __tun_get(tfile);
struct sock *sk = tun->sk;
unsigned int mask = 0;
if (!tun)
return POLLERR;
[1] http://www.cvedetails.com/cve/CVE-2009-1897
[2] http://www.cvedetails.com/cve/CVE-2008-1685