go, branch go1.22.12

[release-branch.go1.22] go1.22.12

2025-02-04T16:39:49Z

Change-Id: Ib985698fba4e6dab8dc645b115e21a9717bd122c Reviewed-on: https://go-review.googlesource.com/c/go/+/646479 Auto-Submit: Gopher Robot Reviewed-by: Cherry Mui TryBot-Bypass: Cherry Mui Reviewed-by: Carlos Amedee

[release-branch.go1.22] crypto/internal/fips140/nistec: make p256NegCond constant time on ppc64le

2025-01-31T17:38:05Z

Remove the branching instruction from p256NegCond which made it variable time. The technique used matches that used in p256MovCond. Fixes #71383 Fixes #71422 Fixes CVE-2025-22866 Change-Id: Ibc2a46814d856cbbdaf6cc0c5a415ed5d42ca793 Reviewed-on: https://go-review.googlesource.com/c/go/+/643735 Reviewed-by: David Chase Reviewed-by: Filippo Valsorda Reviewed-by: Paul Murphy LUCI-TryBot-Result: Go LUCI (cherry picked from commit 6fc23a3cff5e38ff72923fee50f51254dcdc6e93) Reviewed-on: https://go-review.googlesource.com/c/go/+/645535 Reviewed-by: Carlos Amedee TryBot-Bypass: Carlos Amedee

[release-branch.go1.22] cmd/go/internal/modfetch: do not trust server to send all tags in shallow fetch

2025-01-17T16:30:44Z

Newer git versions (at least git 2.47.1) do not send all the matching tags for a shallow fetch of a specific hash anymore. The go command assumes that git servers do this. Since that assumption is broken, use the local copy of the remote refs list to augment the tags sent by the server. This makes the cmd/go/internal/modfetch tests pass again with newer git. For #71261 Fixes #71262 Change-Id: I9fd4f3fd7beeb68a522938599f8f3acd887d0b26 Reviewed-on: https://go-review.googlesource.com/c/go/+/642437 Reviewed-by: Michael Matloob LUCI-TryBot-Result: Go LUCI Auto-Submit: Russ Cox (cherry picked from commit bd80d8956f3062d2b2bff2d7da6b879dfa909f12) Reviewed-on: https://go-review.googlesource.com/c/go/+/642695 Reviewed-by: Russ Cox Reviewed-by: Michael Knyszek

[release-branch.go1.22] cmd/compile: fix write barrier coalescing

2025-01-17T15:41:15Z

We can't coalesce a non-WB store with a subsequent Move, as the result of the store might be the source of the move. There's a simple codegen test. Not sure how we might do a real test, as all the repro's I've come up with are very expensive and unreliable. Fixes #71229 Change-Id: If18bf181a266b9b90964e2591cd2e61a7168371c Reviewed-on: https://go-review.googlesource.com/c/go/+/642197 Reviewed-by: Keith Randall LUCI-TryBot-Result: Go LUCI Reviewed-by: David Chase Reviewed-on: https://go-review.googlesource.com/c/go/+/642499

[release-branch.go1.22] go1.22.11

2025-01-16T20:07:58Z

Change-Id: I7ab7e0219977de1fc313a684c48b78fd0219de81 Reviewed-on: https://go-review.googlesource.com/c/go/+/643156 Reviewed-by: Michael Pratt Reviewed-by: Michael Knyszek Auto-Submit: Gopher Robot LUCI-TryBot-Result: Go LUCI

[release-branch.go1.22] net/http: persist header stripping across repeated redirects

2025-01-16T19:07:07Z

When an HTTP redirect changes the host of a request, we drop sensitive headers such as Authorization from the redirected request. Fix a bug where a chain of redirects could result in sensitive headers being sent to the wrong host: 1. request to a.tld with Authorization header 2. a.tld redirects to b.tld 3. request to b.tld with no Authorization header 4. b.tld redirects to b.tld 3. request to b.tld with Authorization header restored Thanks to Kyle Seely for reporting this issue. Fixes #70530 For #71210 Fixes CVE-2024-45336 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1641 Reviewed-by: Roland Shoemaker Reviewed-by: Tatiana Bradley Commit-Queue: Roland Shoemaker Change-Id: Id7b1e3c90345566b8ee1a51f65dbb179da6eb427 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1765 Reviewed-on: https://go-review.googlesource.com/c/go/+/643106 Reviewed-by: Michael Pratt LUCI-TryBot-Result: Go LUCI Auto-Submit: Michael Knyszek

[release-branch.go1.22] crypto/x509: properly check for IPv6 hosts in URIs

2025-01-16T19:07:05Z

When checking URI constraints, use netip.ParseAddr, which understands zones, unlike net.ParseIP which chokes on them. This prevents zone IDs from mistakenly satisfying URI constraints. Thanks to Juho Forsén of Mattermost for reporting this issue. For #71156 Fixes #71207 Fixes CVE-2024-45341 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1700 Reviewed-by: Tatiana Bradley Reviewed-by: Damien Neil Change-Id: I1d97723e0f29fcf1404fb868ba0495282da70f6e Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1780 Reviewed-by: Roland Shoemaker Reviewed-on: https://go-review.googlesource.com/c/go/+/643105 TryBot-Bypass: Michael Knyszek Reviewed-by: Michael Pratt Auto-Submit: Michael Knyszek

[release-branch.go1.22] runtime: hold traceAcquire across casgstatus in injectglist

2025-01-08T17:58:22Z

Currently injectglist emits all the trace events before actually calling casgstatus on each goroutine. This is a problem, since tracing can observe an inconsistent state (gstatus does not match tracer's 'emitted an event' state). This change fixes the problem by having injectglist do what every other scheduler function does, and that's wrap each call to casgstatus in traceAcquire/traceRelease. For #70883. Fixes #71146. Change-Id: I857e96cec01688013597e8efc0c4c3d0b72d3a70 Reviewed-on: https://go-review.googlesource.com/c/go/+/638558 Reviewed-by: Michael Pratt LUCI-TryBot-Result: Go LUCI (cherry picked from commit f025d19e7b3f0c66242760c213cc2b54cb100f69) Reviewed-on: https://go-review.googlesource.com/c/go/+/641356 Auto-Submit: Michael Pratt

[release-branch.go1.22] crypto/tls: fix Config.Time in tests using expired certificates

2025-01-08T17:33:51Z

Updates #71077 Fixes #71103 Change-Id: I6a6a465685f3bd50a5bb35a160f87b59b74fa6af Reviewed-on: https://go-review.googlesource.com/c/go/+/639655 Auto-Submit: Ian Lance Taylor Reviewed-by: Damien Neil LUCI-TryBot-Result: Go LUCI Auto-Submit: Filippo Valsorda Auto-Submit: Damien Neil Reviewed-by: Joel Sing Reviewed-by: Ian Lance Taylor Reviewed-on: https://go-review.googlesource.com/c/go/+/640237

[release-branch.go1.22] go1.22.10

2024-12-03T18:00:04Z

Change-Id: I5e9be77389bcb215c114013c169841cfbcaa9550 Reviewed-on: https://go-review.googlesource.com/c/go/+/633235 LUCI-TryBot-Result: Go LUCI Reviewed-by: Dmitri Shuralyov Reviewed-by: Veronica Silina Auto-Submit: Gopher Robot Reviewed-by: Michael Knyszek