Re: [MAINTAINERS SUMMIT] Other LLM-related topics - tags, newcomers, etc

[Dan Carpenter <error27@gmail.com>]

I wish people would say describe their process more in commit messages.
Harshit Mogalapalli and I regularly review CVEs to figure out how the
bugs are detected and most of the time it isn't stated in the commit
message.  These examples are all based on guessing and not from anything
which was said in the commit message.

I reviewed a patch and it was sold as a buffer overflow fix but their
actual process was 1) grep for FIXME.  2) Ask AI to implement the FIXME.

Another time, someone sent a security fix and a security company prompted
their AI to fuzz test the heck out of it and discovered that the patch
was incomplete.

Or someone set up a test system to just connect and disconnect the
ethernet in a loop until something broke.  That's a real bug, but there
is no way they hit it except in a test environment.  That sort of
information is useful because we could all add that to our test process.

Or another person set up a virtual test environment and they were able
to produce real stack traces.  These are bugs which can only be triggered
using malicious firmware.  They explained this when pressed but it wasn't
in the original commit message.

What I want in the commit message is more of a description of which
AI prompts were used and the process so I can copy that and discover
other future bugs.

regards,
dan carpenter