go, branch go1.23.9

[release-branch.go1.23] go1.23.9

2025-05-06T18:34:22Z

Change-Id: I5ffeb84b19112888aee4ebffd88c0753b41ac833 Reviewed-on: https://go-review.googlesource.com/c/go/+/670457 Auto-Submit: Gopher Robot Reviewed-by: Carlos Amedee LUCI-TryBot-Result: Go LUCI Reviewed-by: Cherry Mui

[release-branch.go1.23] runtime: fix 9-arg syscall on darwin/amd64

2025-04-28T17:29:49Z

The last 3 arguments need to be passed on the stack, not registers. Fixes #73380 Change-Id: Ib1155ad1a805957fad3d9594c93981a558755591 Reviewed-on: https://go-review.googlesource.com/c/go/+/665435 Reviewed-by: Michael Pratt LUCI-TryBot-Result: Go LUCI Reviewed-by: Keith Randall (cherry picked from commit 9d7de0483861b3f882f79797939566fe8f6f9e24) Reviewed-on: https://go-review.googlesource.com/c/go/+/666015

[release-branch.go1.23] cmd/link: choose one with larger size for duplicated BSS symbols

2025-04-10T15:35:38Z

When two packages declare a variable with the same name (with linkname at least on one side), the linker will choose one as the actual definition of the symbol if one has content (i.e. a DATA symbol) and the other does not (i.e. a BSS symbol). When both have content, it is redefinition error. When neither has content, currently the choice is sort of arbitrary (depending on symbol loading order, etc. which are subject to change). One use case for that is that one wants to reference a symbol defined in another package, and the reference side just wants to see some of the fields, so it may be declared with a smaller type. In this case, we want to choose the one with the larger size as the true definition. Otherwise the code accessing the larger sized one may read/write out of bounds, corrupting the next variable. This CL makes the linker do so. Also include followup fix CL 661915. Fixes #73091. Updates #72032. Change-Id: I160aa9e0234702066cb8f141c186eaa89d0fcfed Reviewed-on: https://go-review.googlesource.com/c/go/+/660696 LUCI-TryBot-Result: Go LUCI Reviewed-by: David Chase Reviewed-by: Than McIntosh (cherry picked from commit 8f6c083d7bf68a766073c50ceb8ea405a3fe7bed) Reviewed-on: https://go-review.googlesource.com/c/go/+/662355 Auto-Submit: Dmitri Shuralyov

[release-branch.go1.23] go1.23.8

2025-04-01T16:11:48Z

Change-Id: Ied6ade315672e373b9b861f09ee0feba4fb8030b Reviewed-on: https://go-review.googlesource.com/c/go/+/662057 LUCI-TryBot-Result: Go LUCI Auto-Submit: Gopher Robot Reviewed-by: Dmitri Shuralyov Reviewed-by: Carlos Amedee

[release-branch.go1.23] runtime: explicitly disable async preempt for internal/runtime

2025-03-26T16:35:14Z

Fixes #72114 For #71591 Relevant CL 560155 Change-Id: Iebc497d56b36d50c13a6dd88e7bca4578a03cf63 Reviewed-on: https://go-review.googlesource.com/c/go/+/654916 LUCI-TryBot-Result: Go LUCI Reviewed-by: Cherry Mui Auto-Submit: Michael Pratt Reviewed-by: Michael Pratt (cherry picked from commit 92a63bdfee9f8347df70293e5733661ae31ae285) Reviewed-on: https://go-review.googlesource.com/c/go/+/660935 Auto-Submit: Dmitri Shuralyov

[release-branch.go1.23] runtime: skip TestCgoCallbackPprof on platforms with broken profiling

2025-03-25T18:51:29Z

CL 658035 added TestCgoCallbackPprof, which is consistently failing on solaris. runtime/pprof maintains a list of platforms where CPU profiling does not work properly. Since this test requires CPU profiling, skip the this test on those platforms. For #72870. For #72876. For #72871. Change-Id: I6a6a636cbf6b16abcbba8771178fe1d001be9d9b Reviewed-on: https://go-review.googlesource.com/c/go/+/658415 LUCI-TryBot-Result: Go LUCI Auto-Submit: Michael Pratt Reviewed-by: Michael Knyszek Reviewed-on: https://go-review.googlesource.com/c/go/+/658435 Reviewed-by: Dmitri Shuralyov Auto-Submit: Dmitri Shuralyov TryBot-Bypass: Dmitri Shuralyov

[release-branch.go1.23] runtime: only set isExtraInC if there are no Go frames left

2025-03-25T18:51:22Z

mp.isExtraInC is intended to indicate that this M has no Go frames at all; it is entirely executing in C. If there was a cgocallback to Go and then a cgocall to C, such that the leaf frames are C, that is fine. e.g., traceback can handle this fine with SetCgoTraceback (or by simply skipping the C frames). However, we currently mismanage isExtraInC, unconditionally setting it on return from cgocallback. This means that if there are two levels of cgocallback, we end up running Go code with isExtraInC set. 1. C-created thread calls into Go function 1 (via cgocallback). 2. Go function 1 calls into C function 1 (via cgocall). 3. C function 1 calls into Go function 2 (via cgocallback). 4. Go function 2 returns back to C function 1 (returning via the remainder of cgocallback). 5. C function 1 returns back to Go function 1 (returning via the remainder of cgocall). 6. Go function 1 is now running with mp.isExtraInC == true. The fix is simple; only set isExtraInC on return from cgocallback if there are no more Go frames. There can't be more Go frames unless there is an active cgocall out of the Go frames. For #72870. Fixes #72871. Cq-Include-Trybots: luci.golang.try:go1.23-linux-amd64-longtest Change-Id: I6a6a636c4e7ba75a29639d7036c5af3738033467 Reviewed-on: https://go-review.googlesource.com/c/go/+/658035 Reviewed-by: Cherry Mui Commit-Queue: Michael Pratt Auto-Submit: Michael Pratt Reviewed-by: Michael Knyszek LUCI-TryBot-Result: Go LUCI (cherry picked from commit 577bb3d0ce576b2ca311e58dd942f189838b80fc) Reviewed-on: https://go-review.googlesource.com/c/go/+/658055 Auto-Submit: Dmitri Shuralyov

[release-branch.go1.23] internal/godebugs: fix changed version for winsymlink and winreadlinkvolume to 1.23

2025-03-24T22:35:29Z

https://go.dev/doc/godebug#go-123 documents changes to winsymlink and winreadlinkvolume in Go 1.23. This fixes the registered "changed" minor version to Go 1.23, so that defaults when building a Go 1.22 module are correct. Fixes #72937 Change-Id: I5d5bf31ca04f9e95208fb0fdaad2232f9db653ff Reviewed-on: https://go-review.googlesource.com/c/go/+/659035 LUCI-TryBot-Result: Go LUCI Reviewed-by: Ian Lance Taylor Auto-Submit: Ian Lance Taylor (cherry picked from commit 2e749a645a6d03c7ac11bb172c4591564061b29e) Reviewed-on: https://go-review.googlesource.com/c/go/+/658976 Reviewed-by: Dmitri Shuralyov Reviewed-by: Dmitri Shuralyov Auto-Submit: Dmitri Shuralyov

[release-branch.go1.23] net/http: reject newlines in chunk-size lines

2025-03-17T21:51:53Z

Unlike request headers, where we are allowed to leniently accept a bare LF in place of a CRLF, chunked bodies must always use CRLF line terminators. We were already enforcing this for chunk-data lines; do so for chunk-size lines as well. Also reject bare CRs anywhere other than as part of the CRLF terminator. Fixes CVE-2025-22871 Fixes #72010 For #71988 Change-Id: Ib0e21af5a8ba28c2a1ca52b72af8e2265ec79e4a Reviewed-on: https://go-review.googlesource.com/c/go/+/652998 Reviewed-by: Jonathan Amsterdam LUCI-TryBot-Result: Go LUCI (cherry picked from commit d31c805535f3fde95646ee4d87636aaaea66847b) Reviewed-on: https://go-review.googlesource.com/c/go/+/657216

[release-branch.go1.23] all: updates vendored x/net

2025-03-04T20:31:19Z

This is to update module version to the fixed x/net. For #71984 Change-Id: I8f4357f14a7d44a782c131eb856b50a103be2f2d Reviewed-on: https://go-review.googlesource.com/c/go/+/654796 Reviewed-by: Junyang Shao Auto-Submit: Junyang Shao Reviewed-by: Michael Pratt LUCI-TryBot-Result: Go LUCI