go, branch go1.23.1

[release-branch.go1.23] go1.23.1

2024-09-05T15:20:23Z

Change-Id: I1f2dab5560d3214c8934074a53f7750d8d431936 Reviewed-on: https://go-review.googlesource.com/c/go/+/611196 Reviewed-by: Michael Pratt Reviewed-by: Dmitri Shuralyov Commit-Queue: Gopher Robot TryBot-Bypass: Dmitri Shuralyov Auto-Submit: Gopher Robot

[release-branch.go1.23] go/build/constraint: add parsing limits

2024-09-05T14:55:17Z

Limit the size of build constraints that we will parse. This prevents a number of stack exhaustions that can be hit when parsing overly complex constraints. The imposed limits are unlikely to ever be hit in real world usage. Updates #69141 Fixes #69149 Fixes CVE-2024-34158 Change-Id: I38b614bf04caa36eefc6a4350d848588c4cef3c4 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1540 Reviewed-by: Damien Neil Reviewed-by: Russ Cox (cherry picked from commit 0c74dc9e0da0cf1e12494b514d822b5bebbc9f04) Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1562 Commit-Queue: Roland Shoemaker Reviewed-by: Tatiana Bradley Reviewed-on: https://go-review.googlesource.com/c/go/+/611177 Reviewed-by: Michael Pratt TryBot-Bypass: Dmitri Shuralyov Reviewed-by: Dmitri Shuralyov Auto-Submit: Dmitri Shuralyov

[release-branch.go1.23] encoding/gob: cover missed cases when checking ignore depth

2024-09-05T14:55:14Z

This change makes sure that we are properly checking the ignored field recursion depth in decIgnoreOpFor consistently. This prevents stack exhaustion when attempting to decode a message that contains an extremely deeply nested struct which is ignored. Thanks to Md Sakib Anwar of The Ohio State University (anwar.40@osu.edu) for reporting this issue. Updates #69139 Fixes #69145 Fixes CVE-2024-34156 Change-Id: Iacce06be95a5892b3064f1c40fcba2e2567862d6 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1440 Reviewed-by: Russ Cox Reviewed-by: Damien Neil (cherry picked from commit 9f2ea73c5f2a7056b7da5d579a485a7216f4b20a) Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1581 Commit-Queue: Roland Shoemaker Reviewed-by: Tatiana Bradley Reviewed-on: https://go-review.googlesource.com/c/go/+/611176 Reviewed-by: Dmitri Shuralyov Auto-Submit: Dmitri Shuralyov Reviewed-by: Michael Pratt TryBot-Bypass: Dmitri Shuralyov

[release-branch.go1.23] go/parser: track depth in nested element lists

2024-09-05T14:55:11Z

Prevents stack exhaustion with extremely deeply nested literal values, i.e. field values in structs. Updates #69138 Fixes #69143 Fixes CVE-2024-34155 Change-Id: I2e8e33b44105cc169d7ed1ae83fb56df0c10f1ee Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1520 Reviewed-by: Robert Griesemer Reviewed-by: Damien Neil Reviewed-by: Russ Cox (cherry picked from commit eb1b038c0d01761694e7a735ef87ac9164c6568e) Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1560 Commit-Queue: Roland Shoemaker Reviewed-by: Tatiana Bradley Reviewed-on: https://go-review.googlesource.com/c/go/+/611175 Auto-Submit: Dmitri Shuralyov Reviewed-by: Dmitri Shuralyov TryBot-Bypass: Dmitri Shuralyov Reviewed-by: Michael Pratt

[release-branch.go1.23] cmd: vendor golang.org/x/telemetry@internal-branch.go1.23-vendor

2024-08-29T00:09:27Z

Update x/telemetry to fix #68976 and #68946. Commands run: go get golang.org/x/telemetry@internal-branch.go1.23-vendor go mod tidy go mod vendor Fixes #68994. Fixes #68995. Change-Id: I63b892ad4c313aa92f21fbd4f519a0b19d725849 Reviewed-on: https://go-review.googlesource.com/c/go/+/609355 LUCI-TryBot-Result: Go LUCI Auto-Submit: Michael Pratt Reviewed-by: Robert Findley

[release-branch.go1.23] database/sql: fix panic with concurrent Conn and Close

2024-08-28T18:37:00Z

The current implementation has a panic when the database is closed concurrently with a new connection attempt. connRequestSet.CloseAndRemoveAll sets connRequestSet.s to a nil slice. If this happens between calls to connRequestSet.Add and connRequestSet.Delete, there is a panic when trying to write to the nil slice. This is sequence is likely to occur in DB.conn, where the mutex is released between calls to db.connRequests.Add and db.connRequests.Delete This change updates connRequestSet.CloseAndRemoveAll to set the curIdx to -1 for all pending requests before setting its internal slice to nil. CloseAndRemoveAll already iterates the full slice to close all the request channels. It seems appropriate to set curIdx to -1 before deleting the slice for 3 reasons: 1. connRequestSet.deleteIndex also sets curIdx to -1 2. curIdx will not be relevant to anything after the slice is set to nil 3. connRequestSet.Delete already checks for negative indices For #68949 Fixes #69041 Change-Id: I6b7ebc5a71b67322908271d13865fa12f2469b87 GitHub-Last-Rev: 7d2669155b24043dd9d276f915689511572f2e49 GitHub-Pull-Request: golang/go#68953 Reviewed-on: https://go-review.googlesource.com/c/go/+/607238 LUCI-TryBot-Result: Go LUCI Auto-Submit: Ian Lance Taylor Commit-Queue: Ian Lance Taylor Reviewed-by: Brad Fitzpatrick Reviewed-by: Cherry Mui Reviewed-by: Dmitri Shuralyov (cherry picked from commit 08707d66c350927560faa11b0c195d37d281ab89) Reviewed-on: https://go-review.googlesource.com/c/go/+/609255

[release-branch.go1.23] go/types, types2: unalias tilde terms in underIs

2024-08-28T18:10:23Z

Unalias the ~T terms during underIs. Before, if T was an alias of U, it may pass T to the iteration function. The iterator function expects an underlying type, under(U), to be passed. This caused several bugs where underIs is used without eventually taking the underlying type. Fixes #68905 Change-Id: Ie8691d8dddaea00e1dcba94d17c0f1b021fc49a2 Reviewed-on: https://go-review.googlesource.com/c/go/+/606075 Reviewed-by: Robert Griesemer LUCI-TryBot-Result: Go LUCI Reviewed-by: Robert Findley (cherry picked from commit 1a90dcdaaf46d9dd0ee61781dcb9b6e05b80d926) Reviewed-on: https://go-review.googlesource.com/c/go/+/607635

[release-branch.go1.23] runtime: store bp on cgocallback as unsafe.Pointer

2024-08-28T17:42:20Z

As of CL 580255, the runtime tracks the frame pointer (or base pointer, bp) when entering syscalls, so that we can use fpTracebackPCs on goroutines that are sitting in syscalls. That CL mostly got things right, but missed one very subtle detail. When calling from Go->C->Go, the goroutine stack performing the calls when returning to Go is free to move around in memory due to growth, shrinking, etc. But upon returning back to C, it needs to restore gp.syscall*, including gp.syscallsp and gp.syscallbp. The way syscallsp currently gets updated is automagically: it's stored as an unsafe.Pointer on the stack so that it shows up in a stack map. If the stack ever moves, it'll get updated correctly. But gp.syscallbp isn't saved to the stack as an unsafe.Pointer, but rather as a uintptr, so it never gets updated! As a result, in rare circumstances, fpTracebackPCs can correctly try to use gp.syscallbp as the starting point for the traceback, but the value is stale. This change fixes the problem by just storing gp.syscallbp to the stack on cgocallback as an unsafe.Pointer, like gp.syscallsp. It also adds a comment documenting this subtlety; the lack of explanation for the unsafe.Pointer type on syscallsp meant this detail was missed -- let's not miss it again in the future. Now, we have a fix, what about a test? Unfortunately, testing this is going to be incredibly annoying because the circumstances under which gp.syscallbp are actually used for traceback are non-deterministic and hard to arrange, especially from within testprogcgo where we don't have export_test.go and can't reach into the runtime. So, instead, add a gp.syscallbp check to reentersyscall and entersyscallblock that mirrors the gp.syscallbp consistency check. This probably causes some miniscule slowdown to the syscall path, but it'll catch the issue without having to actually perform a traceback. For #69085. Fixes #69087. Change-Id: Iaf771758f1666024b854f5fbe2b2c63cbe35b201 Reviewed-on: https://go-review.googlesource.com/c/go/+/608775 Reviewed-by: Nick Ripley LUCI-TryBot-Result: Go LUCI Reviewed-by: Michael Pratt Reviewed-by: Cherry Mui (cherry picked from commit 54fe0fd43fcf8609666c16ae6d15ed92873b1564) Reviewed-on: https://go-review.googlesource.com/c/go/+/608835

[release-branch.go1.23] go/types, types2: use max(fileVersion, go1.21) if fileVersion present

2024-08-28T15:43:17Z

Change the rules for how //go:build "file versions" are applied: instead of considering whether a file version is an upgrade or downgrade from the -lang version, always use max(fileVersion, go1.21). This prevents file versions from downgrading the version below go1.21. Before Go 1.21 the //go:build version did not have the meaning of setting the file's langage version. This fixes an issue that was appearing in GOPATH builds: Go 1.23.0 started providing -lang versions to the compiler in GOPATH mode (among other places) which it wasn't doing before, and it set -lang to the toolchain version (1.23). Because the -lang version was greater than go1.21, language version used to compile the file would be set to the //go:build file version. //go:build file versions below 1.21 could cause files that could previously build to stop building. For example, take a Go file with a //go:build line specifying go1.10. If that file used a 1.18 feature, that use would compile fine with a Go 1.22 toolchain. But it would produce an error when compiling with the 1.23.0 toolchain because it set the language version to 1.10 and disallowed the 1.18 feature. This breaks backwards compatibility: when the build tag was added, it did not have the meaning of restricting the language version. For #68658 Fixes #69094 Change-Id: I6cedda81a55bcccffaa3501eef9e2be6541b6ece Reviewed-on: https://go-review.googlesource.com/c/go/+/607955 LUCI-TryBot-Result: Go LUCI Reviewed-by: Robert Griesemer (cherry picked from commit aeac0b6cbfb42bc9c9301913a191bb09454d316a) Reviewed-on: https://go-review.googlesource.com/c/go/+/608935

[release-branch.go1.23] runtime: on AIX, fix call to _cgo_sys_thread_create in _rt0_ppc64_aix_lib

2024-08-21T20:26:47Z

The AIX ABI requires allocating parameter save space when calling a function, even if the arguments are passed via registers. gcc sometimes uses this space. In the case of the cgo c-archive tests, it clobbered the storage space of argc/argv which prevented the test program from running the expected test. Fixes #68973 Change-Id: I8a267b463b1abb2b37ac85231f6c328f406b7515 Reviewed-on: https://go-review.googlesource.com/c/go/+/606895 Reviewed-by: Ian Lance Taylor LUCI-TryBot-Result: Go LUCI Reviewed-by: Cherry Mui Run-TryBot: Paul Murphy TryBot-Result: Gopher Robot Reviewed-on: https://go-review.googlesource.com/c/go/+/607195 Reviewed-by: Dmitri Shuralyov