go, branch go1.19.11

[release-branch.go1.19] go1.19.11

2023-07-11T16:38:32Z

Change-Id: Ic6685cba7c4cf96dfc0c837df90002f557e9e86a Reviewed-on: https://go-review.googlesource.com/c/go/+/508837 TryBot-Result: Gopher Robot Run-TryBot: Gopher Robot Reviewed-by: Cherry Mui Reviewed-by: Heschi Kreinick Auto-Submit: Gopher Robot

[release-branch.go1.19] net/http: validate Host header before sending

2023-07-06T19:41:20Z

Verify that the Host header we send is valid. Avoids surprising behavior such as a Host of "go.dev\r\nX-Evil:oops" adding an X-Evil header to HTTP/1 requests. Add a test, skip the test for HTTP/2. HTTP/2 is not vulnerable to header injection in the way HTTP/1 is, but x/net/http2 doesn't validate the header and will go into a retry loop when the server rejects it. CL 506995 adds the necessary validation to x/net/http2. Updates #60374 Fixes #61075 For CVE-2023-29406 Change-Id: I05cb6866a9bead043101954dfded199258c6dd04 Reviewed-on: https://go-review.googlesource.com/c/go/+/506996 Reviewed-by: Tatiana Bradley TryBot-Result: Gopher Robot Run-TryBot: Damien Neil (cherry picked from commit 499458f7ca04087958987a33c2703c3ef03e27e2) Reviewed-on: https://go-review.googlesource.com/c/go/+/507358 Run-TryBot: Tatiana Bradley Reviewed-by: Roland Shoemaker

[release-branch.go1.19] runtime: set raceignore to zero when starting a new goroutine

2023-06-29T15:53:25Z

When reusing a g struct the runtime did not reset g.raceignore. Initialize raceignore to zero when initially setting racectx. A goroutine can end with a non-zero raceignore if it exits after calling runtime.RaceDisable without a matching runtime.RaceEnable. If that goroutine's g is later reused the race detector is in a weird state: the underlying g.racectx is active, yet g.raceignore is non-zero, and raceacquire/racerelease which check g.raceignore become no-ops. This causes the race detector to report races when there are none. For #60934 Fixes #60948 Change-Id: Ib8e412f11badbaf69a480f03740da70891f4093f Reviewed-on: https://go-review.googlesource.com/c/go/+/505055 Reviewed-by: Dmitri Shuralyov Reviewed-by: Michael Knyszek TryBot-Result: Gopher Robot Run-TryBot: Michael Knyszek (cherry picked from commit 48dbb6227acf3ebc8ac21924567aa2b6d5064915) Reviewed-on: https://go-review.googlesource.com/c/go/+/505675 Reviewed-by: Keith Randall Reviewed-by: Keith Randall TryBot-Bypass: Carlos Amedee

[release-branch.go1.19] runtime: allow for 5 more threads in TestWindowsStackMemory*

2023-06-28T20:54:33Z

Original version of TestWindowsStackMemory did not consider sysmon and other threads running during the test. Allow for 5 extra threads in this test - this should cover any new threads in the future. For #58570 Fixes #61054 Change-Id: I215790f9b94ff40a32ddd7aa54af715d1dc391c6 Reviewed-on: https://go-review.googlesource.com/c/go/+/473415 Reviewed-by: Michael Pratt Run-TryBot: Alex Brainman TryBot-Result: Gopher Robot Reviewed-by: Cherry Mui (cherry picked from commit f6cbc1da05da141a78ee33954b52d17642c95130) Reviewed-on: https://go-review.googlesource.com/c/go/+/506975 Run-TryBot: Michael Knyszek Auto-Submit: Michael Knyszek (cherry picked from commit 08a58dd8b6337c9bac93face4c386a918a3dd97b) Reviewed-on: https://go-review.googlesource.com/c/go/+/506976 Reviewed-by: Dmitri Shuralyov

[release-branch.go1.19] cmd/go: skip TestScript/gccgo_link_ldflags on aix/ppc64

2023-06-24T02:35:33Z

The gccgo on the builder is not updated to support runtime/cgo For #60306. For #60513. Change-Id: If0fb1ccdf589cc9741f6a065bacfa4f06e64ec15 Reviewed-on: https://go-review.googlesource.com/c/go/+/501435 Reviewed-by: Ian Lance Taylor TryBot-Result: Gopher Robot Run-TryBot: Cuong Manh Le Reviewed-by: Benny Siegert Auto-Submit: Cuong Manh Le (cherry picked from commit 688d75b14fd7646d66c18825f22f0a67e9fafd9e) Reviewed-on: https://go-review.googlesource.com/c/go/+/505596 Auto-Submit: Dmitri Shuralyov Reviewed-by: Than McIntosh Reviewed-by: Dmitri Shuralyov Run-TryBot: Dmitri Shuralyov

[release-branch.go1.19] runtime: use 1-byte load for address checking in racecallatomic

2023-06-22T15:15:07Z

In racecallatomic, we do a load before calling into TSAN, so if the address is invalid we fault on the Go stack. We currently use a 8-byte load instruction, regardless of the data size that the atomic operation is performed on. So if, say, we are doing a LoadUint32 at an address that is the last 4 bytes of a memory mapping, we may fault unexpectedly. Do a 1-byte load instead. (Ideally we should do a load with the right size, so we fault correctly if we're given an unaligned address for a wide load across a page boundary. Leave that for another CL.) Fix AMD64, ARM64, and PPC64. The code already uses 1-byte load on S390X. Fixes #60844. Updates #60825. Change-Id: I3dee93eb08ba180c85e86a9d2e71b5b520e8dcf0 Reviewed-on: https://go-review.googlesource.com/c/go/+/503937 Run-TryBot: Cherry Mui TryBot-Result: Gopher Robot Reviewed-by: Than McIntosh Reviewed-by: David Chase (cherry picked from commit 1a7709d6af76c06d465c5e969b502fc206f8e687) Reviewed-on: https://go-review.googlesource.com/c/go/+/503977 Auto-Submit: Dmitri Shuralyov TryBot-Bypass: Dmitri Shuralyov Reviewed-by: Austin Clements

[release-branch.go1.19] cmd/go: retain extra roots to disambiguate imports in 'go mod tidy'

2023-06-19T22:56:58Z

We don't normally keep explicit requirements for test dependencies of packages loaded from other modules when the required version is already the selected version in the module graph. However, in some cases we may need to keep an explicit requirement in order to make use of lazy module loading to disambiguate an otherwise-ambiguous import. Note that there is no Go version guard for this change: in the cases where the behavior of 'go mod tidy' has changed, previous versions of Go would produce go.mod files that break successive calls to 'go mod tidy'. Given that, I suspect that any existing user in the wild affected by this bug either already has a workaround in place using redundant import statements (in which case the change does not affect them) or is running 'go mod tidy -e' to force past the error (in which case a change in behavior to a non-error should not be surprising). Updates #60313. Fixes #60351. Change-Id: Idf294f72cbe3904b871290d79e4493595a0c7bfc Reviewed-on: https://go-review.googlesource.com/c/go/+/496635 Auto-Submit: Bryan Mills Run-TryBot: Bryan Mills Reviewed-by: Russ Cox TryBot-Result: Gopher Robot (cherry picked from commit 2ed6a54a39339ca37e9da4530b3f37a9d29b7c84) Reviewed-on: https://go-review.googlesource.com/c/go/+/499636 TryBot-Bypass: Bryan Mills Auto-Submit: Dmitri Shuralyov Reviewed-by: Michael Matloob

[release-branch.go1.19] cmd/pprof: skip TestDisasm on ARM64

2023-06-19T15:52:13Z

The test is fixed at tip, but it is non-trivial enough to backport to (potentionally the last) Go 1.19 minor release. Skip the test. Fixes #60637. Change-Id: I0425b703a5270b680346b63ab38c47b890a3a3bf Reviewed-on: https://go-review.googlesource.com/c/go/+/501824 TryBot-Result: Gopher Robot Auto-Submit: Dmitri Shuralyov Run-TryBot: Cherry Mui Reviewed-by: Michael Knyszek

[release-branch.go1.19] cmd/go/internal/work: make formatOutput return an error that includes the import path

2023-06-13T20:00:09Z

This refines the error output that was previously adjusted in CL 437298. Longer term, we should consider unraveling the call chains involving formatOutput to avoid passing so many parameters through so many different formatting functions. Updates #60710. Updates #60650. Updates #25842. Change-Id: I3b9d03bf5968902d8ccc4841ab4dbe114a2239e4 Reviewed-on: https://go-review.googlesource.com/c/go/+/451218 Reviewed-by: Bryan Mills Auto-Submit: Russ Cox Reviewed-by: Russ Cox Run-TryBot: Russ Cox Reviewed-by: Than McIntosh TryBot-Result: Gopher Robot Reviewed-on: https://go-review.googlesource.com/c/go/+/502196 Reviewed-by: Dmitri Shuralyov TryBot-Bypass: Bryan Mills Run-TryBot: Bryan Mills Reviewed-by: Michael Matloob

[release-branch.go1.19] cmd/go: do not exit with non-zero code from go list -e -export

2023-06-13T20:00:04Z

go list -e -export puts errors running build actions on the load.Package corresponding to the failed action rather than exiting with a non zero exit code. Fixes #60710. Fixes #60650. Updates #25842. Change-Id: I1fea85cc5a0557f514fe9d4ed3b6a858376fdcde Reviewed-on: https://go-review.googlesource.com/c/go/+/437298 Run-TryBot: Bryan Mills Reviewed-by: Bryan Mills TryBot-Result: Gopher Robot Auto-Submit: Bryan Mills Reviewed-by: Michael Matloob Reviewed-on: https://go-review.googlesource.com/c/go/+/502195 TryBot-Bypass: Bryan Mills Reviewed-by: Dmitri Shuralyov