Re: [RFC] docs: netdev: additional info requirements for bug fixes

[Jakub Kicinski <kuba@kernel.org>]

On Wed, 29 Jul 2026 00:56:31 +0200 Sabrina Dubroca wrote:
> 2026-07-28, 18:17:27 +0200, Matthieu Baerts wrote:
> > > I see what you're trying to do, but making regular contributors append
> > > 2 paragraphs to their commit messages (or ask their LLM to generate
> > > them, and also fight for an hour to get a reproducer that actually
> > > does something) just to check the box seems painful. Reading the git
> > > log with all this stuff mixed in will be worse.
> > > 
> > > As someone who's probably never sent a compliant patch, and who has a
> > > tendency to forget new rules (especially those that are inconvenient):
> > > meh. I don't think the commit messages we've been writing all this
> > > time have been so bad.  
> > 
> > Are these rules mostly for new contributors using AI to generate
> > patches?  
> 
> Based on the commit message, I guess yes. Based on Jakub's reply, I
> would say no.

Regular contributors sometimes also act on AI reports with no hard
proof. That said, it's always entirely okay to say "Found by code
analysis, and fix is untested." For regular contributors the reputation
will outweigh the testing. For everyone else we will ask them to test.

> > I guess regular contributors are already applying these rules,
> > either by using a Reported-by tag, pasting a call trace, or describing
> > how the bug was discovered, no?  
> 
> Reported-by doesn't describe how the bug was discovered, just that it
> was discovered by someone else than the author of the commit. It can
> just as well be an AI report, CI testing, someone else's manual code
> inspection, or a "real life" bug.
> 
> The call trace could have been produced by adding delays to help
> trigger a race found by code inspection, or seen in real life but not
> reproduced by the patch author.
> 
> I'm not sure code inspection vs some tool (AI or not) makes much
> difference, at least when the patch submitter has enough experience to
> check the output of the tool before writing/sending the patch.

Fair, I couldn't think of an intuitive category which would cover both.

> Without checking git history, I suspect there's been a bunch of fixes
> for issues found via code inspection or sparse that were not actually
> triggered/reproduced. The code was obviously wrong, it gets fixed. AI
> makes reproducers cheap(er), but not free (in both tokens and
> prompting time).
> 
> "Impact to the user" is probably missing in most fixes I've sent (or
> severely lacking, ie nothing more than UAF/memleak).
> [a few examples: 52501989c762 cbada1048847 5502bc4746e8]
> 
> But I could see an argument for "well we should have started
> mentioning testing and impact to user ages ago".
> 
> > I find this important to understand how the bug was discovered, and ask
> > for a reproducer or another sort of proof when this is a "potential
> > issue found by an AI code review agent". Otherwise, that means the
> > reviewers have to do the validation, which will certainly take them
> > longer than the author to generate the patch.  
> 
> Sure.
> 
> > I don't think regular contributors have to change their commit messages, no?  

Not tomorrow, but I'd hope the ask is not too onerous?

> If that's the case, good. But "quote this text at people until they
> comply" and "get an AI bot looking at all patches coming in" doesn't
> sound like that to me.

IMO it's really very useful for reviewers to know if the author
triggered the issue. Also, for downstream backporters it's useful 
to know in case of conflict whether to invest time in resolving
or the patch is mostly theoretical and waiting until next major is fine.

I'm also guilty of not adding "impact to the user" info, but that
requires thinking and theorizing. The ask here is to purely state
the facts.

FWIW the immediate trigger for me is the people who started sending
sloppy fixes to drivers that nobody uses. I ask them about the
discovery process and half of the time they don't even respond.