database/sql: context cancellation allows statements to execute after rollback [1.14 backport]

[gopherbot]

@leighmcculloch requested issue #34775 to be considered for backport to the next 1.14 minor release.

@odeke-em I believe this fix satisfies the requirements for a backport according to the minor version release policy because the issue is a serious issue that is causing databases to get into bad state where no work around is possible and updating to the latest release Go 1.14.3 does not fix the issue.

If patching Go is the suggested work around that suggests there is no work around in an application. Unfortunately building custom Go isn't an option for everyone as our product is open source and so we'd need to ask everyone who uses it to build with a custom Go.

@gopherbot please consider this for backport because this issue breaks production applications resulting in unexpected database state and cannot be fixed with a work around including updating the version of Go to the latest version.

[andybons]

Approved

[leighmcculloch]

@andybons Thanks for approving the backport 🎉. I only need this fixed in Go 1.14 but given 1.13 is still a supported Go version should I also open a backport issue for this for Go 1.13?

[andybons]

@leighmcculloch up to you. If the backport CL applies cleanly or otherwise without too much fuss then go for it.

[odeke-em]

The CLs don't apply cleanly, there are some merge conflicts with Go1.14, but also the 3 CLs were mailed in a relation chain, so that's tricky too. @kardianos could you please help with composing the backport CLs? Thank you.

[kardianos]

The only way to apply this would likely be to pull the full chain with it, or devise a new patch with the same effect. This fix relied on another fix prior to it I believe.

[kardianos]

On a desktop now. If you do a backport, you should cherry pick both https://go-review.googlesource.com/c/go/+/216197 and https://go-review.googlesource.com/c/go/+/216240 . These won't apply cleanly because they were after the change that fixes the session resetter.

[fednerjuste]

Has this change been released in 1.14

[brbaker]

Will this make it into the announced release of 1.14.5 on July 14, 2020?