all: update vendored golang.org/x/net

Pull in HTTP/2 fix to deflake builders:

    547e7edf38 http2: avoid referencing ResponseWrite.Write parameter after returning

For #58446

Change-Id: I7f3666bc1f20ee03a7ccf25f0e091033cbc635d7
Reviewed-on: https://go-review.googlesource.com/c/go/+/467657
Auto-Submit: Damien Neil <dneil@google.com>
Run-TryBot: Damien Neil <dneil@google.com>
Reviewed-by: Bryan Mills <bcmills@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>

4 files changed, 29 insertions, 8 deletions

diff --git a/src/go.mod b/src/go.mod
index 35ce39e94a..628d488de2 100644
--- a/src/go.mod
+++ b/src/go.mod
@@ -4,7 +4,7 @@ go 1.21
 
 require (
 	golang.org/x/crypto v0.5.1-0.20230203195927-310bfa40f1e4
-	golang.org/x/net v0.5.1-0.20230208184008-87ce33ecb484
+	golang.org/x/net v0.6.1-0.20230213185550-547e7edf3873
 )
 
 require (
diff --git a/src/go.sum b/src/go.sum
index bd92c7cd98..8fa7143519 100644
--- a/src/go.sum
+++ b/src/go.sum
@@ -1,7 +1,7 @@
 golang.org/x/crypto v0.5.1-0.20230203195927-310bfa40f1e4 h1:8CmdfDrqo5/AGztF4Zk/aBNGTgL5dgcfPMmmvH1z8Lo=
 golang.org/x/crypto v0.5.1-0.20230203195927-310bfa40f1e4/go.mod h1:NK/OQwhpMQP3MwtdjgLlYHnH9ebylxKWv3e0fK+mkQU=
-golang.org/x/net v0.5.1-0.20230208184008-87ce33ecb484 h1:reOs7qLeFybNpg5gc2AYupdrdhj7HHdlwchxHN00Ab0=
-golang.org/x/net v0.5.1-0.20230208184008-87ce33ecb484/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.6.1-0.20230213185550-547e7edf3873 h1:Q3VygVi8kE7fuxQsipcDKKY2No9tcbUM60WcMl2uqYE=
+golang.org/x/net v0.6.1-0.20230213185550-547e7edf3873/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/sys v0.5.1-0.20230208141308-4fee21c92339 h1:qejQWXLeAs3eO3KUJ7VrThA+k04v3zo/FhGln8EizY0=
 golang.org/x/sys v0.5.1-0.20230208141308-4fee21c92339/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/text v0.7.1-0.20230207171107-30dadde3188b h1:/WbjM0nb7XdqglHRPb40OoA+bJr3ZR/TFeNAF139Jyw=
diff --git a/src/net/http/h2_bundle.go b/src/net/http/h2_bundle.go
index eb3fd159f8..b451cee9dc 100644
--- a/src/net/http/h2_bundle.go
+++ b/src/net/http/h2_bundle.go
@@ -2063,6 +2063,15 @@ func (f *http2Framer) WriteData(streamID uint32, endStream bool, data []byte) er
 // It is the caller's responsibility not to violate the maximum frame size
 // and to not call other Write methods concurrently.
 func (f *http2Framer) WriteDataPadded(streamID uint32, endStream bool, data, pad []byte) error {
+	if err := f.startWriteDataPadded(streamID, endStream, data, pad); err != nil {
+		return err
+	}
+	return f.endWrite()
+}
+
+// startWriteDataPadded is WriteDataPadded, but only writes the frame to the Framer's internal buffer.
+// The caller should call endWrite to flush the frame to the underlying writer.
+func (f *http2Framer) startWriteDataPadded(streamID uint32, endStream bool, data, pad []byte) error {
 	if !http2validStreamID(streamID) && !f.AllowIllegalWrites {
 		return http2errStreamID
 	}
@@ -2092,7 +2101,7 @@ func (f *http2Framer) WriteDataPadded(streamID uint32, endStream bool, data, pad
 	}
 	f.wbuf = append(f.wbuf, data...)
 	f.wbuf = append(f.wbuf, pad...)
-	return f.endWrite()
+	return nil
 }
 
 // A SettingsFrame conveys configuration parameters that affect how
@@ -4653,8 +4662,13 @@ type http2frameWriteResult struct {
 // and then reports when it's done.
 // At most one goroutine can be running writeFrameAsync at a time per
 // serverConn.
-func (sc *http2serverConn) writeFrameAsync(wr http2FrameWriteRequest) {
-	err := wr.write.writeFrame(sc)
+func (sc *http2serverConn) writeFrameAsync(wr http2FrameWriteRequest, wd *http2writeData) {
+	var err error
+	if wd == nil {
+		err = wr.write.writeFrame(sc)
+	} else {
+		err = sc.framer.endWrite()
+	}
 	sc.wroteFrameCh <- http2frameWriteResult{wr: wr, err: err}
 }
 
@@ -5063,9 +5077,16 @@ func (sc *http2serverConn) startFrameWrite(wr http2FrameWriteRequest) {
 		sc.writingFrameAsync = false
 		err := wr.write.writeFrame(sc)
 		sc.wroteFrame(http2frameWriteResult{wr: wr, err: err})
+	} else if wd, ok := wr.write.(*http2writeData); ok {
+		// Encode the frame in the serve goroutine, to ensure we don't have
+		// any lingering asynchronous references to data passed to Write.
+		// See https://go.dev/issue/58446.
+		sc.framer.startWriteDataPadded(wd.streamID, wd.endStream, wd.p, nil)
+		sc.writingFrameAsync = true
+		go sc.writeFrameAsync(wr, wd)
 	} else {
 		sc.writingFrameAsync = true
-		go sc.writeFrameAsync(wr)
+		go sc.writeFrameAsync(wr, nil)
 	}
 }
 
diff --git a/src/vendor/modules.txt b/src/vendor/modules.txt
index 306d253ec1..9d584d321b 100644
--- a/src/vendor/modules.txt
+++ b/src/vendor/modules.txt
@@ -7,7 +7,7 @@ golang.org/x/crypto/cryptobyte/asn1
 golang.org/x/crypto/hkdf
 golang.org/x/crypto/internal/alias
 golang.org/x/crypto/internal/poly1305
-# golang.org/x/net v0.5.1-0.20230208184008-87ce33ecb484
+# golang.org/x/net v0.6.1-0.20230213185550-547e7edf3873
 ## explicit; go 1.17
 golang.org/x/net/dns/dnsmessage
 golang.org/x/net/http/httpguts