Well, to be fair, the NULL check was in a wrong place. The pointer was already dereferenced before the check. struct tun_struct *tun = __tun_get(tfile); st

Well, to be fair, the NULL check was in a wrong place. The pointer was already dereferenced before the check. struct tun_struct *tun = __tun_get(tfile); struct sock *sk = tun->sk; unsigned int mask = 0; if (!tun) return POLLERR;