net/http: ResponseController panic

[komuw]

What version of Go are you using (go version)?

$ go version
go version go1.20 linux/amd64

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/home//.cache/go-build"
GOENV="/home//.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home//go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home//go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.20"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/home//Downloads/cool/go.mod"
GOWORK=""
CGO_CFLAGS="-O2 -g"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-O2 -g"
CGO_FFLAGS="-O2 -g"
CGO_LDFLAGS="-O2 -g"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -fdebug-prefix-map=/run/user/1000/go-build839916512=/tmp/go-build -gno-record-gcc-switches"

What did you do?

Run the program; https://go.dev/play/p/Alu2e-LdzqX?v=gotip
and then use curl to access it curl -vkL https://127.0.0.1:56782/

What did you expect to see?

No panic, possibly an error

What did you see instead?

listening on  :56782
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x7471f5]

goroutine 22 [running]:
net/http.(*http2pipe).CloseWithError(...)
        /usr/local/go/src/net/http/h2_bundle.go:3718
net/http.(*http2stream).onReadTimeout(0xc00024e0b0)
        /usr/local/go/src/net/http/h2_bundle.go:5639 +0xd5
created by time.goFunc
        /usr/local/go/src/time/sleep.go:176 +0x48
exit status 2

[cuiweixie]

this line cause panic, add If st.Body == nil maybe a choice to fix this. but I am not very sure.

[seankhliao]

cc @neild

[gopherbot]

Change https://go.dev/cl/464936 mentions this issue: http2: check stream body is present on read timeout

[gopherbot]

Change https://go.dev/cl/465035 mentions this issue: net/http: add ResponseController http2 request without body read deadline test

[lwithers]

Is there any further information that would be helpful for this issue? It can still be reproduced in Go 1.20.5, and prohibits the use of http.ResponseController.SetReadDeadline() in many real-world deployments (at least where TLS is enabled, since it's HTTP/2-specific).