go, branch go1.23.6

[release-branch.go1.23] go1.23.6

2025-02-04T16:39:47Z

Change-Id: Iec54508cfd791299630ae4b784667cd2643c4c15 Reviewed-on: https://go-review.googlesource.com/c/go/+/646221 Reviewed-by: Carlos Amedee Reviewed-by: Cherry Mui Auto-Submit: Gopher Robot TryBot-Bypass: Cherry Mui

[release-branch.go1.23] crypto/internal/fips140/nistec: make p256NegCond constant time on ppc64le

2025-01-31T17:38:23Z

Remove the branching instruction from p256NegCond which made it variable time. The technique used matches that used in p256MovCond. Fixes #71383 Fixes #71423 Fixes CVE-2025-22866 Change-Id: Ibc2a46814d856cbbdaf6cc0c5a415ed5d42ca793 Reviewed-on: https://go-review.googlesource.com/c/go/+/643735 Reviewed-by: David Chase Reviewed-by: Filippo Valsorda Reviewed-by: Paul Murphy LUCI-TryBot-Result: Go LUCI (cherry picked from commit 6fc23a3cff5e38ff72923fee50f51254dcdc6e93) Reviewed-on: https://go-review.googlesource.com/c/go/+/645515 Reviewed-by: Carlos Amedee

[release-branch.go1.23] cmd/go/internal/modfetch: do not trust server to send all tags in shallow fetch

2025-01-17T16:30:53Z

Newer git versions (at least git 2.47.1) do not send all the matching tags for a shallow fetch of a specific hash anymore. The go command assumes that git servers do this. Since that assumption is broken, use the local copy of the remote refs list to augment the tags sent by the server. This makes the cmd/go/internal/modfetch tests pass again with newer git. For #71261 Fixes #71263 Change-Id: I9fd4f3fd7beeb68a522938599f8f3acd887d0b26 Reviewed-on: https://go-review.googlesource.com/c/go/+/642437 Reviewed-by: Michael Matloob LUCI-TryBot-Result: Go LUCI Auto-Submit: Russ Cox (cherry picked from commit bd80d8956f3062d2b2bff2d7da6b879dfa909f12) Reviewed-on: https://go-review.googlesource.com/c/go/+/642696 Reviewed-by: Michael Knyszek Reviewed-by: Russ Cox

[release-branch.go1.23] cmd/compile: fix write barrier coalescing

2025-01-17T15:41:09Z

We can't coalesce a non-WB store with a subsequent Move, as the result of the store might be the source of the move. There's a simple codegen test. Not sure how we might do a real test, as all the repro's I've come up with are very expensive and unreliable. Fixes #71230 Change-Id: If18bf181a266b9b90964e2591cd2e61a7168371c Reviewed-on: https://go-review.googlesource.com/c/go/+/642197 Reviewed-by: Keith Randall LUCI-TryBot-Result: Go LUCI Reviewed-by: David Chase Reviewed-on: https://go-review.googlesource.com/c/go/+/642498

[release-branch.go1.23] go1.23.5

2025-01-16T20:07:56Z

Change-Id: I849328cf93adf24c223f103f5b834635970ea652 Reviewed-on: https://go-review.googlesource.com/c/go/+/643137 Reviewed-by: Michael Knyszek Reviewed-by: Michael Pratt Auto-Submit: Gopher Robot LUCI-TryBot-Result: Go LUCI

[release-branch.go1.23] net/http: persist header stripping across repeated redirects

2025-01-16T19:00:39Z

When an HTTP redirect changes the host of a request, we drop sensitive headers such as Authorization from the redirected request. Fix a bug where a chain of redirects could result in sensitive headers being sent to the wrong host: 1. request to a.tld with Authorization header 2. a.tld redirects to b.tld 3. request to b.tld with no Authorization header 4. b.tld redirects to b.tld 3. request to b.tld with Authorization header restored Thanks to Kyle Seely for reporting this issue. For #70530 Fixes ##71211 Fixes CVE-2024-45336 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1641 Reviewed-by: Roland Shoemaker Reviewed-by: Tatiana Bradley Commit-Queue: Roland Shoemaker Change-Id: I326544358de71ff892d9e9fe338252a5dd04001f Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1764 Reviewed-on: https://go-review.googlesource.com/c/go/+/643104 Auto-Submit: Michael Knyszek LUCI-TryBot-Result: Go LUCI Reviewed-by: Michael Pratt

[release-branch.go1.23] crypto/x509: properly check for IPv6 hosts in URIs

2025-01-16T19:00:37Z

When checking URI constraints, use netip.ParseAddr, which understands zones, unlike net.ParseIP which chokes on them. This prevents zone IDs from mistakenly satisfying URI constraints. Thanks to Juho Forsén of Mattermost for reporting this issue. For #71156 Fixes #71208 Fixes CVE-2024-45341 Change-Id: Iecac2529f3605382d257996e0fb6d6983547e400 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1700 Reviewed-by: Tatiana Bradley Reviewed-by: Damien Neil (cherry picked from commit 22ca55d396ba801e6ae9b2bd67a059fcb30562fd) Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1762 Reviewed-by: Roland Shoemaker Reviewed-on: https://go-review.googlesource.com/c/go/+/643103 LUCI-TryBot-Result: Go LUCI Auto-Submit: Michael Knyszek Reviewed-by: Michael Pratt

[release-branch.go1.23] runtime: hold traceAcquire across casgstatus in injectglist

2025-01-08T18:02:57Z

Currently injectglist emits all the trace events before actually calling casgstatus on each goroutine. This is a problem, since tracing can observe an inconsistent state (gstatus does not match tracer's 'emitted an event' state). This change fixes the problem by having injectglist do what every other scheduler function does, and that's wrap each call to casgstatus in traceAcquire/traceRelease. For #70883. Fixes #71147. Change-Id: I857e96cec01688013597e8efc0c4c3d0b72d3a70 Reviewed-on: https://go-review.googlesource.com/c/go/+/638558 Reviewed-by: Michael Pratt LUCI-TryBot-Result: Go LUCI (cherry picked from commit f025d19e7b3f0c66242760c213cc2b54cb100f69) Reviewed-on: https://go-review.googlesource.com/c/go/+/641378 Auto-Submit: Michael Pratt

[release-branch.go1.23] crypto/tls: fix Config.Time in tests using expired certificates

2025-01-08T17:33:16Z

Updates #71077 Fixes #71104 Change-Id: I6a6a465685f3bd50a5bb35a160f87b59b74fa6af Reviewed-on: https://go-review.googlesource.com/c/go/+/639655 Auto-Submit: Ian Lance Taylor Reviewed-by: Damien Neil LUCI-TryBot-Result: Go LUCI Auto-Submit: Filippo Valsorda Auto-Submit: Damien Neil Reviewed-by: Joel Sing Reviewed-by: Ian Lance Taylor Reviewed-on: https://go-review.googlesource.com/c/go/+/640315 Reviewed-by: Filippo Valsorda

[release-branch.go1.23] net: don't use sendfile for irregular files; handle EOPNOTSUPP/ENOTSUP

2024-12-18T17:42:15Z

This is not a cherry pick, because the code has changed on tip. For #70763 Fixes #70789 Change-Id: If9fcfee17e86a746cf8c72293dc34f80b430f6e6 Reviewed-on: https://go-review.googlesource.com/c/go/+/635397 Auto-Submit: Ian Lance Taylor Reviewed-by: Dmitri Shuralyov Reviewed-by: Damien Neil LUCI-TryBot-Result: Go LUCI