Re: [PATCH v3 3/7] docs: stable-kernel-rules: drop rules the stable trees do not apply

[Sasha Levin <sashal@kernel.org>]

On Fri, Oct 16, 2026 at 05:01:54PM +0100, Bradley Morgan wrote:
>On 16 October 2026 16:28:23 BST, Sasha Levin <sashal@kernel.org> wrote:
>>-- It must be obviously correct and tested.
>>-- It cannot be bigger than 100 lines, with context.
>>+- It must be correct and tested.
>
>s/tested/fully tested ?
>
>'Tested" to agents would be just a basic compile test, maybe we could
>define here what you want the agent to do?
>
>E.g: a W1? A QEMU repro? And others.

This rule applies to every stable patch, and the right testing differs a
lot between, say, a driver fix and an mm change, so I'd rather not pin it
down here. For agents, coding-assistants.rst already covers it: the fix
has to be checked with the reproducer or a full re-analysis, and the
agent has to say explicitly when it could not be built or tested.

>>   - No "trivial" fixes without benefit for users (spelling changes, whitespace
>>     cleanups, etc).
>
>What I tend to do when I use AI on my own projects to find bugs are to get
>it to "verify" what it finds to be a good enough bug. Could you refer to
>the security document here? That could help very well for AI agents to
>find proper bugs.

stable-kernel-rules.rst already points security fixes at
security-bugs.rst, and coding-assistants.rst has agents read
threat-model.rst to decide whether a bug is a vulnerability.

>Id also suggest that perhaps you *could* make a new patch saying that
>
>"When finding bugs, you need to verify that this bug is severe enough to
>need stable backporting or a CVE, if you reckon it is not severe enough
>for them, if it's not reproducible, eliminate the bug from the results"

I'd rather not. A bug that doesn't qualify for stable still needs a fix
in mainline, and many real bugs, races in particular, are hard to
reproduce; that is why this patch drops the "theoretical race" rule. CVEs
are assigned by the CVE team once a fix is in a stable tree, so the
finder doesn't need to decide that.

Confirming that a bug is real before reporting it is the part that
matters, and coding-assistants.rst already asks for a reproducer.

-- 
Thanks,
Sasha