From: Cherry Mui <cherryyz@google.com>
Date: Fri, 12 Dec 2025 18:00:54 +0000 (-0500)
Subject: cmd/link: add new linknames to blocked linkname list
X-Git-Tag: go1.26rc1~1^2~11
X-Git-Url: http://www.git.cypherpunks.su/?a=commitdiff_plain;h=34af879dde;p=gostls13.git

cmd/link: add new linknames to blocked linkname list

Update the blocklist with new linknames added in Go 1.26.

Some goroutine leak profile symbols were manually added but they
did not match the actual symbol names. Corrected.

runtime.freegc is not itself push-linknamed, so there is no need
to explicitly add it to blocklist. Keep the test, to ensure one
cannot linkname-pull freegc.

Change-Id: Ie5fd6bc191e9afa164fa79055cc39e6fa9ed4c7f
Reviewed-on: https://go-review.googlesource.com/c/go/+/729720
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: David Chase <drchase@google.com>
---

diff --git a/src/cmd/link/internal/loader/loader.go b/src/cmd/link/internal/loader/loader.go
index 57029a1300..9ac2b9201d 100644
--- a/src/cmd/link/internal/loader/loader.go
+++ b/src/cmd/link/internal/loader/loader.go
@@ -2420,6 +2420,7 @@ var blockedLinknames = map[string][]string{
 	"internal/runtime/maps.fatal":           {"internal/runtime/maps"},
 	"internal/runtime/maps.newarray":        {"internal/runtime/maps"},
 	"internal/runtime/maps.newobject":       {"internal/runtime/maps"},
+	"internal/runtime/maps.rand":            {"internal/runtime/maps"},
 	"internal/runtime/maps.typedmemclr":     {"internal/runtime/maps"},
 	"internal/runtime/maps.typedmemmove":    {"internal/runtime/maps"},
 	"internal/sync.fatal":                   {"internal/sync"},
@@ -2449,8 +2450,6 @@ var blockedLinknames = map[string][]string{
 	"runtime.mapdelete_faststr":  {"runtime"},
 	// New internal linknames in Go 1.25
 	// Pushed from runtime
-	"crypto/subtle.setDITEnabled":                    {"crypto/subtle"},
-	"crypto/subtle.setDITDisabled":                   {"crypto/subtle"},
 	"internal/cpu.riscvHWProbe":                      {"internal/cpu"},
 	"internal/runtime/cgroup.throw":                  {"internal/runtime/cgroup"},
 	"internal/runtime/maps.typeString":               {"internal/runtime/maps"},
@@ -2463,14 +2462,34 @@ var blockedLinknames = map[string][]string{
 	"sync_test.runtime_blockUntilEmptyCleanupQueue":  {"sync_test"},
 	"time.runtimeIsBubbled":                          {"time"},
 	"unique.runtime_blockUntilEmptyCleanupQueue":     {"unique"},
-	// Experimental features
-	"runtime.goroutineLeakGC":    {"runtime/pprof"},
-	"runtime.goroutineleakcount": {"runtime/pprof"},
-	"runtime.freegc":             {}, // disallow all packages
 	// Others
 	"net.newWindowsFile":                   {"net"},              // pushed from os
 	"testing/synctest.testingSynctestTest": {"testing/synctest"}, // pushed from testing
-	"runtime.addmoduledata":                {},                   // disallow all packages
+	// New internal linknames in Go 1.26
+	// Pushed from runtime
+	"crypto/fips140.isBypassed":                    {"crypto/fips140"},
+	"crypto/fips140.setBypass":                     {"crypto/fips140"},
+	"crypto/fips140.unsetBypass":                   {"crypto/fips140"},
+	"crypto/subtle.setDITEnabled":                  {"crypto/subtle"},
+	"crypto/subtle.setDITDisabled":                 {"crypto/subtle"},
+	"internal/cpu.sysctlbynameBytes":               {"internal/cpu"},
+	"internal/cpu.sysctlbynameInt32":               {"internal/cpu"},
+	"runtime.pprof_goroutineLeakProfileWithLabels": {"runtime/pprof"},
+	"runtime/pprof.runtime_goroutineLeakGC":        {"runtime/pprof"},
+	"runtime/pprof.runtime_goroutineleakcount":     {"runtime/pprof"},
+	"runtime/secret.appendSignalStacks":            {"runtime/secret"},
+	"runtime/secret.count":                         {"runtime/secret"},
+	"runtime/secret.dec":                           {"runtime/secret"},
+	"runtime/secret.eraseSecrets":                  {"runtime/secret"},
+	"runtime/secret.getStack":                      {"runtime/secret"},
+	"runtime/secret.inc":                           {"runtime/secret"},
+	"syscall.rawsyscalln":                          {"syscall"},
+	"syscall.runtimeClearenv":                      {"syscall"},
+	"syscall.syscalln":                             {"syscall"},
+	// Others
+	"crypto/internal/rand.SetTestingReader": {"testing/cryptotest"}, // pushed from crypto/internal/rand
+	"testing.checkParallel":                 {"testing/cryptotest"}, // pushed from testing
+	"runtime.addmoduledata":                 {},                     // assembly symbol, disallow all packages
 }
 
 // check if a linkname reference to symbol s from pkg is allowed