Well, to be fair, the NULL check was in a wrong place. The pointer was already dereferenced before the check.

  struct tun_struct *tun = __tun_get(tfile);
  struct sock *sk = tun->sk;
  unsigned int mask = 0;
  
  if (!tun)
    return POLLERR;