net/http: http2 round tripper nil pointer dereference causes panic causing deadlock [1.22 backport]

[gopherbot]

@neild requested issue #65927 to be considered for backport to the next 1.22 minor release.

@niallnsec Thanks, that gives me some added confidence that we've correctly identified the root cause.

Historically, we haven't backported HTTP/2 fixes that can be applied by importing golang.org/x/net/http2 and using ConfigureServer to swap out the bundled implementation. I think that for clear bugs with no workaround short of using an entirely different package, we should be a bit more aggressive about backports, though, so:

@gopherbot please open backport issues. This is an HTTP/2 bug with no good workaround.

[thanm]

Checking in on this issue (wearing my release interrupts hat) -- I see the CherryPickApproved label but don't see a cherrypick CL. @neild if I can be of help let me know.

[neild]

The x/net repo doesn't have an internal-branch.go1.22-vendor branch created yet, so I haven't been able to create the cherrypick CL.

[thanm]

The x/net repo doesn't have an internal-branch.go1.22-vendor branch created yet, so I haven't been able to create the cherrypick CL.

internal-branch.go1.22-vendor should be set up at this point, thanks.

[gopherbot]

Change https://go.dev/cl/574875 mentions this issue: [internal-branch.go1.22-vendor] http2: reject DATA frames after 1xx and before final headers

[gopherbot]

Change https://go.dev/cl/574935 mentions this issue: [release-branch.go1.22] all: update golang.org/x/net

[gopherbot]

Closed by merging 4edf4bb to release-branch.go1.22.