[RFC] docs: netdev: additional info requirements for bug fixes

[RFC] docs: netdev: additional info requirements for bug fixes

[Jakub Kicinski]

Knowing how AI generated patches were tested would be great help
when reviewing them. Explicitly ask people to describe discovery
and validation process they followed.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
 Documentation/process/maintainer-netdev.rst | 28 +++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/Documentation/process/maintainer-netdev.rst b/Documentation/process/maintainer-netdev.rst
index ec7b9aa2877f..ffec42effe66 100644
--- a/Documentation/process/maintainer-netdev.rst
+++ b/Documentation/process/maintainer-netdev.rst
@@ -263,6 +263,34 @@ as a patch to the list with a commit message explaining the technical
 problems with the reverted commit. Reverts should be used as a last resort,
 when original change is completely wrong; incremental fixes are preferred.
 
+Bug fixes
+~~~~~~~~~
+
+All bug fixes must clearly state how the issue was discovered and validated,
+and how the fix was tested. This should be done in plain English, not with
+special tags or annotations.
+
+Example statements describing discovery:
+
+- discovered by a non-AI static analysis tool.
+- discovered by an AI code review agent.
+- discovered by manual code inspection.
+- triggered during code development.
+- triggered in CI testing.
+- observed on a machine in real use.
+
+If the issue was not observed in reality (e.g. it was caught by an AI tool
+or manual code inspection), the next sentence should describe the
+reproduction. The reproduction should state whether kernel modifications
+were necessary (e.g. inserting a delay to widen the race). The commit message
+must disclose if error injection or loading a special kernel module was used
+to trigger the issue. The reproduction steps should be included in the commit
+message if they are short (roughly 10 lines or fewer); longer reproducers can
+be posted online with a link included.
+
+The testing statement should explain whether the fix was tested against the
+reproducer and against kernel selftests.
+
 Stable tree
 ~~~~~~~~~~~
 
-- 
2.55.0

Re: [RFC] docs: netdev: additional info requirements for bug fixes

[Jakub Kicinski]

On Mon, 27 Jul 2026 13:47:24 -0700 Jakub Kicinski wrote:
> +All bug fixes must clearly state how the issue was discovered and validated,
> +and how the fix was tested. This should be done in plain English, not with
> +special tags or annotations.
> +
> +Example statements describing discovery:
> +
> +- discovered by a non-AI static analysis tool.
> +- discovered by an AI code review agent.
> +- discovered by manual code inspection.
> +- triggered during code development.
> +- triggered in CI testing.
> +- observed on a machine in real use.
> +
> +If the issue was not observed in reality (e.g. it was caught by an AI tool
> +or manual code inspection), the next sentence should describe the
> +reproduction. The reproduction should state whether kernel modifications
> +were necessary (e.g. inserting a delay to widen the race). The commit message
> +must disclose if error injection or loading a special kernel module was used
> +to trigger the issue. The reproduction steps should be included in the commit
> +message if they are short (roughly 10 lines or fewer); longer reproducers can
> +be posted online with a link included.
> +
> +The testing statement should explain whether the fix was tested against the
> +reproducer and against kernel selftests.

We should probably also add that the commit message of a fix must
describe the impact to the user.

FWIW the intention is that we'd either quote this text at people
until they comply or even get an AI bot looking at all patches coming
in and deciding if commit message is good enough. With some tuning
LLM should be able to check that the 4 items are covered.

Re: [RFC] docs: netdev: additional info requirements for bug fixes

[Sabrina Dubroca]

2026-07-27, 15:25:17 -0700, Jakub Kicinski wrote:
> On Mon, 27 Jul 2026 13:47:24 -0700 Jakub Kicinski wrote:
> > +All bug fixes must clearly state how the issue was discovered and validated,
> > +and how the fix was tested. This should be done in plain English, not with
> > +special tags or annotations.
> > +
> > +Example statements describing discovery:
> > +
> > +- discovered by a non-AI static analysis tool.
> > +- discovered by an AI code review agent.
> > +- discovered by manual code inspection.
> > +- triggered during code development.
> > +- triggered in CI testing.
> > +- observed on a machine in real use.
> > +
> > +If the issue was not observed in reality (e.g. it was caught by an AI tool
> > +or manual code inspection), the next sentence should describe the
> > +reproduction. The reproduction should state whether kernel modifications
> > +were necessary (e.g. inserting a delay to widen the race). The commit message
> > +must disclose if error injection or loading a special kernel module was used
> > +to trigger the issue. The reproduction steps should be included in the commit
> > +message if they are short (roughly 10 lines or fewer); longer reproducers can
> > +be posted online with a link included.
> > +
> > +The testing statement should explain whether the fix was tested against the
> > +reproducer and against kernel selftests.
> 
> We should probably also add that the commit message of a fix must
> describe the impact to the user.
> 
> FWIW the intention is that we'd either quote this text at people
> until they comply or even get an AI bot looking at all patches coming
> in and deciding if commit message is good enough. With some tuning
> LLM should be able to check that the 4 items are covered.

I see what you're trying to do, but making regular contributors append
2 paragraphs to their commit messages (or ask their LLM to generate
them, and also fight for an hour to get a reproducer that actually
does something) just to check the box seems painful. Reading the git
log with all this stuff mixed in will be worse.

As someone who's probably never sent a compliant patch, and who has a
tendency to forget new rules (especially those that are inconvenient):
meh. I don't think the commit messages we've been writing all this
time have been so bad.

OTOH maybe that's the only way to handle the volume of AI slop
"fixes". 2 more paragraphs when the commit for a trivial 1-line fix is
already 2 pages long doesn't make much difference.

-- 
Sabrina

Re: [RFC] docs: netdev: additional info requirements for bug fixes

[Matthieu Baerts]

Hi Sabrina, Jakub,

Thank you for the patch and the review!

On 28/07/2026 03:08, Sabrina Dubroca wrote:
> 2026-07-27, 15:25:17 -0700, Jakub Kicinski wrote:
>> On Mon, 27 Jul 2026 13:47:24 -0700 Jakub Kicinski wrote:
>>> +All bug fixes must clearly state how the issue was discovered and validated,
>>> +and how the fix was tested. This should be done in plain English, not with
>>> +special tags or annotations.
>>> +
>>> +Example statements describing discovery:
>>> +
>>> +- discovered by a non-AI static analysis tool.
>>> +- discovered by an AI code review agent.
>>> +- discovered by manual code inspection.
>>> +- triggered during code development.
>>> +- triggered in CI testing.
>>> +- observed on a machine in real use.
>>> +
>>> +If the issue was not observed in reality (e.g. it was caught by an AI tool
>>> +or manual code inspection), the next sentence should describe the
>>> +reproduction. The reproduction should state whether kernel modifications
>>> +were necessary (e.g. inserting a delay to widen the race). The commit message
>>> +must disclose if error injection or loading a special kernel module was used
>>> +to trigger the issue. The reproduction steps should be included in the commit
>>> +message if they are short (roughly 10 lines or fewer); longer reproducers can
>>> +be posted online with a link included.
>>> +
>>> +The testing statement should explain whether the fix was tested against the
>>> +reproducer and against kernel selftests.
>>
>> We should probably also add that the commit message of a fix must
>> describe the impact to the user.
>>
>> FWIW the intention is that we'd either quote this text at people
>> until they comply or even get an AI bot looking at all patches coming
>> in and deciding if commit message is good enough. With some tuning
>> LLM should be able to check that the 4 items are covered.
> 
> I see what you're trying to do, but making regular contributors append
> 2 paragraphs to their commit messages (or ask their LLM to generate
> them, and also fight for an hour to get a reproducer that actually
> does something) just to check the box seems painful. Reading the git
> log with all this stuff mixed in will be worse.
> 
> As someone who's probably never sent a compliant patch, and who has a
> tendency to forget new rules (especially those that are inconvenient):
> meh. I don't think the commit messages we've been writing all this
> time have been so bad.

Are these rules mostly for new contributors using AI to generate
patches? I guess regular contributors are already applying these rules,
either by using a Reported-by tag, pasting a call trace, or describing
how the bug was discovered, no?

I find this important to understand how the bug was discovered, and ask
for a reproducer or another sort of proof when this is a "potential
issue found by an AI code review agent". Otherwise, that means the
reviewers have to do the validation, which will certainly take them
longer than the author to generate the patch.

I don't think regular contributors have to change their commit messages, no?

> OTOH maybe that's the only way to handle the volume of AI slop
> "fixes". 2 more paragraphs when the commit for a trivial 1-line fix is
> already 2 pages long doesn't make much difference.

:)

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Re: [RFC] docs: netdev: additional info requirements for bug fixes

[Sabrina Dubroca]

2026-07-28, 18:17:27 +0200, Matthieu Baerts wrote:
> Hi Sabrina, Jakub,
> 
> Thank you for the patch and the review!
> 
> On 28/07/2026 03:08, Sabrina Dubroca wrote:
> > 2026-07-27, 15:25:17 -0700, Jakub Kicinski wrote:
> >> On Mon, 27 Jul 2026 13:47:24 -0700 Jakub Kicinski wrote:
> >>> +All bug fixes must clearly state how the issue was discovered and validated,
> >>> +and how the fix was tested. This should be done in plain English, not with
> >>> +special tags or annotations.
> >>> +
> >>> +Example statements describing discovery:
> >>> +
> >>> +- discovered by a non-AI static analysis tool.
> >>> +- discovered by an AI code review agent.
> >>> +- discovered by manual code inspection.
> >>> +- triggered during code development.
> >>> +- triggered in CI testing.
> >>> +- observed on a machine in real use.
> >>> +
> >>> +If the issue was not observed in reality (e.g. it was caught by an AI tool
> >>> +or manual code inspection), the next sentence should describe the
> >>> +reproduction. The reproduction should state whether kernel modifications
> >>> +were necessary (e.g. inserting a delay to widen the race). The commit message
> >>> +must disclose if error injection or loading a special kernel module was used
> >>> +to trigger the issue. The reproduction steps should be included in the commit
> >>> +message if they are short (roughly 10 lines or fewer); longer reproducers can
> >>> +be posted online with a link included.
> >>> +
> >>> +The testing statement should explain whether the fix was tested against the
> >>> +reproducer and against kernel selftests.
> >>
> >> We should probably also add that the commit message of a fix must
> >> describe the impact to the user.
> >>
> >> FWIW the intention is that we'd either quote this text at people
> >> until they comply or even get an AI bot looking at all patches coming
> >> in and deciding if commit message is good enough. With some tuning
> >> LLM should be able to check that the 4 items are covered.
> > 
> > I see what you're trying to do, but making regular contributors append
> > 2 paragraphs to their commit messages (or ask their LLM to generate
> > them, and also fight for an hour to get a reproducer that actually
> > does something) just to check the box seems painful. Reading the git
> > log with all this stuff mixed in will be worse.
> > 
> > As someone who's probably never sent a compliant patch, and who has a
> > tendency to forget new rules (especially those that are inconvenient):
> > meh. I don't think the commit messages we've been writing all this
> > time have been so bad.
> 
> Are these rules mostly for new contributors using AI to generate
> patches?

Based on the commit message, I guess yes. Based on Jakub's reply, I
would say no.

> I guess regular contributors are already applying these rules,
> either by using a Reported-by tag, pasting a call trace, or describing
> how the bug was discovered, no?

Reported-by doesn't describe how the bug was discovered, just that it
was discovered by someone else than the author of the commit. It can
just as well be an AI report, CI testing, someone else's manual code
inspection, or a "real life" bug.

The call trace could have been produced by adding delays to help
trigger a race found by code inspection, or seen in real life but not
reproduced by the patch author.

I'm not sure code inspection vs some tool (AI or not) makes much
difference, at least when the patch submitter has enough experience to
check the output of the tool before writing/sending the patch.

Without checking git history, I suspect there's been a bunch of fixes
for issues found via code inspection or sparse that were not actually
triggered/reproduced. The code was obviously wrong, it gets fixed. AI
makes reproducers cheap(er), but not free (in both tokens and
prompting time).

"Impact to the user" is probably missing in most fixes I've sent (or
severely lacking, ie nothing more than UAF/memleak).
[a few examples: 52501989c762 cbada1048847 5502bc4746e8]

But I could see an argument for "well we should have started
mentioning testing and impact to user ages ago".

> I find this important to understand how the bug was discovered, and ask
> for a reproducer or another sort of proof when this is a "potential
> issue found by an AI code review agent". Otherwise, that means the
> reviewers have to do the validation, which will certainly take them
> longer than the author to generate the patch.

Sure.

> I don't think regular contributors have to change their commit messages, no?

If that's the case, good. But "quote this text at people until they
comply" and "get an AI bot looking at all patches coming in" doesn't
sound like that to me.

-- 
Sabrina

Re: [RFC] docs: netdev: additional info requirements for bug fixes

[Jakub Kicinski]

On Wed, 29 Jul 2026 00:56:31 +0200 Sabrina Dubroca wrote:
> 2026-07-28, 18:17:27 +0200, Matthieu Baerts wrote:
> > > I see what you're trying to do, but making regular contributors append
> > > 2 paragraphs to their commit messages (or ask their LLM to generate
> > > them, and also fight for an hour to get a reproducer that actually
> > > does something) just to check the box seems painful. Reading the git
> > > log with all this stuff mixed in will be worse.
> > > 
> > > As someone who's probably never sent a compliant patch, and who has a
> > > tendency to forget new rules (especially those that are inconvenient):
> > > meh. I don't think the commit messages we've been writing all this
> > > time have been so bad.  
> > 
> > Are these rules mostly for new contributors using AI to generate
> > patches?  
> 
> Based on the commit message, I guess yes. Based on Jakub's reply, I
> would say no.

Regular contributors sometimes also act on AI reports with no hard
proof. That said, it's always entirely okay to say "Found by code
analysis, and fix is untested." For regular contributors the reputation
will outweigh the testing. For everyone else we will ask them to test.

> > I guess regular contributors are already applying these rules,
> > either by using a Reported-by tag, pasting a call trace, or describing
> > how the bug was discovered, no?  
> 
> Reported-by doesn't describe how the bug was discovered, just that it
> was discovered by someone else than the author of the commit. It can
> just as well be an AI report, CI testing, someone else's manual code
> inspection, or a "real life" bug.
> 
> The call trace could have been produced by adding delays to help
> trigger a race found by code inspection, or seen in real life but not
> reproduced by the patch author.
> 
> I'm not sure code inspection vs some tool (AI or not) makes much
> difference, at least when the patch submitter has enough experience to
> check the output of the tool before writing/sending the patch.

Fair, I couldn't think of an intuitive category which would cover both.

> Without checking git history, I suspect there's been a bunch of fixes
> for issues found via code inspection or sparse that were not actually
> triggered/reproduced. The code was obviously wrong, it gets fixed. AI
> makes reproducers cheap(er), but not free (in both tokens and
> prompting time).
> 
> "Impact to the user" is probably missing in most fixes I've sent (or
> severely lacking, ie nothing more than UAF/memleak).
> [a few examples: 52501989c762 cbada1048847 5502bc4746e8]
> 
> But I could see an argument for "well we should have started
> mentioning testing and impact to user ages ago".
> 
> > I find this important to understand how the bug was discovered, and ask
> > for a reproducer or another sort of proof when this is a "potential
> > issue found by an AI code review agent". Otherwise, that means the
> > reviewers have to do the validation, which will certainly take them
> > longer than the author to generate the patch.  
> 
> Sure.
> 
> > I don't think regular contributors have to change their commit messages, no?  

Not tomorrow, but I'd hope the ask is not too onerous?

> If that's the case, good. But "quote this text at people until they
> comply" and "get an AI bot looking at all patches coming in" doesn't
> sound like that to me.

IMO it's really very useful for reviewers to know if the author
triggered the issue. Also, for downstream backporters it's useful 
to know in case of conflict whether to invest time in resolving
or the patch is mostly theoretical and waiting until next major is fine.

I'm also guilty of not adding "impact to the user" info, but that
requires thinking and theorizing. The ask here is to purely state
the facts.

FWIW the immediate trigger for me is the people who started sending
sloppy fixes to drivers that nobody uses. I ask them about the
discovery process and half of the time they don't even respond.