From 9d17654d594af4a459d83a611acc5b672a4867c7 Mon Sep 17 00:00:00 2001
From: Yufan Su <yufans@google.com>
Date: Tue, 20 Oct 2026 15:19:25 -0700
Subject: [PATCH] Add input validation on netns.GetFromName

---
 internal/netns/netns.go            | 15 +++++++++++++--
 internal/netns/netns_linux_test.go |  7 +++++++
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/internal/netns/netns.go b/internal/netns/netns.go
index 41ba1adcb2..2c55ab0577 100644
--- a/internal/netns/netns.go
+++ b/internal/netns/netns.go
@@ -40,9 +40,20 @@ type Handle = vishnetns.NsHandle
 
 // GetFromName opens the namespace of that name under /run/netns.
 func GetFromName(name string) (Handle, error) {
+	if err := validateName(name); err != nil {
+		return -1, err
+	}
 	return vishnetns.GetFromName(name)
 }
 
+// validateName rejects names that would resolve outside /run/netns.
+func validateName(name string) error {
+	if name == "" || name == "." || name == ".." || strings.ContainsAny(name, "/\x00") {
+		return fmt.Errorf("invalid network namespace name %q: %w", name, os.ErrInvalid)
+	}
+	return nil
+}
+
 // CreateNamed creates a named netns and returns its handle, restoring the
 // caller's current netns before returning.
 //
@@ -86,8 +97,8 @@ func CreateNamed(name string) (Handle, error) {
 // it if it is a symlink. A name that is already gone is not an error, and the
 // namespace itself survives for as long as something holds it open.
 func RemoveNamed(name string) error {
-	if name == "" || name == "." || name == ".." || strings.ContainsAny(name, "/\x00") {
-		return fmt.Errorf("invalid network namespace name %q: %w", name, os.ErrInvalid)
+	if err := validateName(name); err != nil {
+		return err
 	}
 	path := filepath.Join("/run/netns", name)
 	if err := unix.Unmount(path, unix.MNT_DETACH|unix.UMOUNT_NOFOLLOW); err != nil && !errors.Is(err, unix.ENOENT) && !errors.Is(err, unix.EINVAL) {
diff --git a/internal/netns/netns_linux_test.go b/internal/netns/netns_linux_test.go
index 313a4bdd76..40f578e1d8 100644
--- a/internal/netns/netns_linux_test.go
+++ b/internal/netns/netns_linux_test.go
@@ -40,6 +40,13 @@ func TestNamedNetNSRejectsInvalidNames(t *testing.T) {
 			if !errors.Is(err, os.ErrInvalid) {
 				t.Fatalf("CreateNamed(%q): got %v, want invalid name", name, err)
 			}
+			handle, err = GetFromName(name)
+			if err == nil {
+				handle.Close()
+			}
+			if !errors.Is(err, os.ErrInvalid) {
+				t.Fatalf("GetFromName(%q): got %v, want invalid name", name, err)
+			}
 		})
 	}
 }