From 9a4feec24fcce8becc9474fc1306fcfb0bc42bdd Mon Sep 17 00:00:00 2001
From: Etienne Perot <eperot@google.com>
Date: Thu, 15 Aug 2024 17:56:51 -0700
Subject: [PATCH] Add a Syzkaller smoke test to the gVisor release process.

This test verifies that gVisor can run as a fuzzable kernel in Syzkaller.

Depends on https://github.com/google/syzkaller/pull/5037

PiperOrigin-RevId: 663522395
---
 .buildkite/pipeline.yaml |  7 +++++++
 .buildkite/release.yaml  |  7 +++++++
 Makefile                 | 41 ++++++++++++++++++++++++++++++++++++++++
 3 files changed, 55 insertions(+)

diff --git a/.buildkite/pipeline.yaml b/.buildkite/pipeline.yaml
index 2761dadbc..b43df6bb2 100644
--- a/.buildkite/pipeline.yaml
+++ b/.buildkite/pipeline.yaml
@@ -578,6 +578,13 @@ steps:
     agents:
       <<: *platform_specific_agents
       arch: "amd64"
+  - <<: *common
+    <<: *source_test_continuous
+    label: ":slot_machine: Syzkaller smoke test"
+    commands:
+      - make syzkaller-smoke-test
+    agents:
+      arch: "amd64"
 
   # Run basic benchmarks smoke tests (no upload).
   - <<: *common
diff --git a/.buildkite/release.yaml b/.buildkite/release.yaml
index 5d1b0ce49..d38721dd2 100644
--- a/.buildkite/release.yaml
+++ b/.buildkite/release.yaml
@@ -33,6 +33,13 @@ steps:
       - make ARCH=aarch64 push-all-images
     agents:
       arch: "arm64"
+  - <<: *common
+    label: ":slot_machine: Syzkaller smoke test"
+    if: build.branch == "master" && build.tag == null
+    commands:
+      - make syzkaller-smoke-test
+    agents:
+      arch: "amd64"
   - <<: *common
     label: ":ship: Release"
     if: build.branch == "master" || build.tag != null
diff --git a/Makefile b/Makefile
index 5556ef9fa..86cd5f896 100644
--- a/Makefile
+++ b/Makefile
@@ -568,6 +568,47 @@ webhook-update: test/kubernetes/gvisor-injection-admission-webhook.yaml.in
 	cat $< | sed -e "s|%WEBHOOK%|$${WEBHOOK}|g" | sed -e "s|%INIT%|$${INIT}|g" > test/kubernetes/gvisor-injection-admission-webhook.yaml
 .PHONY: webhook-update
 
+## Syzkaller smoke test.
+##
+##   This verifies that gVisor can run as a fuzzable kernel in Syzkaller.
+##   https://github.com/google/syzkaller
+##
+##   If this test is broken, chances are that you either modified gVisor
+##   in a way that makes it incompatible with Syzkaller, or that Syzkaller
+##   changed in a way that makes gVisor no longer work with it.
+##   This test runs the same test as Syzkaller does as part of its test
+##   suite:
+##   https://github.com/google/syzkaller/blob/master/tools/gvisor-smoke-test.sh
+##
+##   The following variables may be set:
+##     SYZKALLER_IMAGE     - The name of the container image.
+##     SYZKALLER_CONTAINER - The name of the running container.
+##     SYZKALLER_REPO_URL  - The git URL of the Syzkaller repository.
+##
+SYZKALLER_IMAGE     ?= gcr.io/syzkaller/syzbot:latest
+SYZKALLER_CONTAINER ?= gvisor-syz-$(HASH)-$(ARCH)
+SYZKALLER_REPO_URL  ?= https://github.com/google/syzkaller
+syzkaller-smoke-test: $(RUNTIME_BIN)
+	@docker rm -f $(SYZKALLER_CONTAINER) 2>/dev/null || true && \
+	docker run --rm \
+		--name="$(SYZKALLER_CONTAINER)" \
+		--runtime="$(UNSANDBOXED_RUNTIME)" \
+		--hostname="$(SYZKALLER_CONTAINER)" \
+		$(DOCKER_PRIVILEGED) \
+		--pid=host \
+		-v "$(RUNTIME_BIN):$(RUNTIME_BIN):ro" \
+		-e "GOPATH=/__w/syzkaller/syzkaller/gopath" \
+		-e "GVISOR_VMLINUX_PATH=$(RUNTIME_BIN)" \
+		"$(SYZKALLER_IMAGE)" \
+		/bin/bash -xeuc ' \
+			mkdir -p "$$GOPATH/src/github.com/google" && \
+			git clone --depth=1 https://github.com/google/syzkaller "$$GOPATH/src/github.com/google/syzkaller" && \
+			cd "$$GOPATH/src/github.com/google/syzkaller" && \
+			make && \
+			bash tools/gvisor-smoke-test.sh \
+		'
+.PHONY: syzkaller-smoke-test
+
 ##
 ## Repository builders.
 ##