[RFC] docs: netdev: additional info requirements for bug fixes

[RFC] docs: netdev: additional info requirements for bug fixes

[Jakub Kicinski]

Knowing how AI generated patches were tested would be great help
when reviewing them. Explicitly ask people to describe discovery
and validation process they followed.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
 Documentation/process/maintainer-netdev.rst | 28 +++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/Documentation/process/maintainer-netdev.rst b/Documentation/process/maintainer-netdev.rst
index ec7b9aa2877f..ffec42effe66 100644
--- a/Documentation/process/maintainer-netdev.rst
+++ b/Documentation/process/maintainer-netdev.rst
@@ -263,6 +263,34 @@ as a patch to the list with a commit message explaining the technical
 problems with the reverted commit. Reverts should be used as a last resort,
 when original change is completely wrong; incremental fixes are preferred.
 
+Bug fixes
+~~~~~~~~~
+
+All bug fixes must clearly state how the issue was discovered and validated,
+and how the fix was tested. This should be done in plain English, not with
+special tags or annotations.
+
+Example statements describing discovery:
+
+- discovered by a non-AI static analysis tool.
+- discovered by an AI code review agent.
+- discovered by manual code inspection.
+- triggered during code development.
+- triggered in CI testing.
+- observed on a machine in real use.
+
+If the issue was not observed in reality (e.g. it was caught by an AI tool
+or manual code inspection), the next sentence should describe the
+reproduction. The reproduction should state whether kernel modifications
+were necessary (e.g. inserting a delay to widen the race). The commit message
+must disclose if error injection or loading a special kernel module was used
+to trigger the issue. The reproduction steps should be included in the commit
+message if they are short (roughly 10 lines or fewer); longer reproducers can
+be posted online with a link included.
+
+The testing statement should explain whether the fix was tested against the
+reproducer and against kernel selftests.
+
 Stable tree
 ~~~~~~~~~~~
 
-- 
2.55.0

Re: [RFC] docs: netdev: additional info requirements for bug fixes

[Jakub Kicinski]

On Mon, 27 Jul 2026 13:47:24 -0700 Jakub Kicinski wrote:
> +All bug fixes must clearly state how the issue was discovered and validated,
> +and how the fix was tested. This should be done in plain English, not with
> +special tags or annotations.
> +
> +Example statements describing discovery:
> +
> +- discovered by a non-AI static analysis tool.
> +- discovered by an AI code review agent.
> +- discovered by manual code inspection.
> +- triggered during code development.
> +- triggered in CI testing.
> +- observed on a machine in real use.
> +
> +If the issue was not observed in reality (e.g. it was caught by an AI tool
> +or manual code inspection), the next sentence should describe the
> +reproduction. The reproduction should state whether kernel modifications
> +were necessary (e.g. inserting a delay to widen the race). The commit message
> +must disclose if error injection or loading a special kernel module was used
> +to trigger the issue. The reproduction steps should be included in the commit
> +message if they are short (roughly 10 lines or fewer); longer reproducers can
> +be posted online with a link included.
> +
> +The testing statement should explain whether the fix was tested against the
> +reproducer and against kernel selftests.

We should probably also add that the commit message of a fix must
describe the impact to the user.

FWIW the intention is that we'd either quote this text at people
until they comply or even get an AI bot looking at all patches coming
in and deciding if commit message is good enough. With some tuning
LLM should be able to check that the 4 items are covered.

Re: [RFC] docs: netdev: additional info requirements for bug fixes

[Sabrina Dubroca]

2026-07-27, 15:25:17 -0700, Jakub Kicinski wrote:
> On Mon, 27 Jul 2026 13:47:24 -0700 Jakub Kicinski wrote:
> > +All bug fixes must clearly state how the issue was discovered and validated,
> > +and how the fix was tested. This should be done in plain English, not with
> > +special tags or annotations.
> > +
> > +Example statements describing discovery:
> > +
> > +- discovered by a non-AI static analysis tool.
> > +- discovered by an AI code review agent.
> > +- discovered by manual code inspection.
> > +- triggered during code development.
> > +- triggered in CI testing.
> > +- observed on a machine in real use.
> > +
> > +If the issue was not observed in reality (e.g. it was caught by an AI tool
> > +or manual code inspection), the next sentence should describe the
> > +reproduction. The reproduction should state whether kernel modifications
> > +were necessary (e.g. inserting a delay to widen the race). The commit message
> > +must disclose if error injection or loading a special kernel module was used
> > +to trigger the issue. The reproduction steps should be included in the commit
> > +message if they are short (roughly 10 lines or fewer); longer reproducers can
> > +be posted online with a link included.
> > +
> > +The testing statement should explain whether the fix was tested against the
> > +reproducer and against kernel selftests.
> 
> We should probably also add that the commit message of a fix must
> describe the impact to the user.
> 
> FWIW the intention is that we'd either quote this text at people
> until they comply or even get an AI bot looking at all patches coming
> in and deciding if commit message is good enough. With some tuning
> LLM should be able to check that the 4 items are covered.

I see what you're trying to do, but making regular contributors append
2 paragraphs to their commit messages (or ask their LLM to generate
them, and also fight for an hour to get a reproducer that actually
does something) just to check the box seems painful. Reading the git
log with all this stuff mixed in will be worse.

As someone who's probably never sent a compliant patch, and who has a
tendency to forget new rules (especially those that are inconvenient):
meh. I don't think the commit messages we've been writing all this
time have been so bad.

OTOH maybe that's the only way to handle the volume of AI slop
"fixes". 2 more paragraphs when the commit for a trivial 1-line fix is
already 2 pages long doesn't make much difference.

-- 
Sabrina

Re: [RFC] docs: netdev: additional info requirements for bug fixes

[Matthieu Baerts]

Hi Sabrina, Jakub,

Thank you for the patch and the review!

On 28/07/2026 03:08, Sabrina Dubroca wrote:
> 2026-07-27, 15:25:17 -0700, Jakub Kicinski wrote:
>> On Mon, 27 Jul 2026 13:47:24 -0700 Jakub Kicinski wrote:
>>> +All bug fixes must clearly state how the issue was discovered and validated,
>>> +and how the fix was tested. This should be done in plain English, not with
>>> +special tags or annotations.
>>> +
>>> +Example statements describing discovery:
>>> +
>>> +- discovered by a non-AI static analysis tool.
>>> +- discovered by an AI code review agent.
>>> +- discovered by manual code inspection.
>>> +- triggered during code development.
>>> +- triggered in CI testing.
>>> +- observed on a machine in real use.
>>> +
>>> +If the issue was not observed in reality (e.g. it was caught by an AI tool
>>> +or manual code inspection), the next sentence should describe the
>>> +reproduction. The reproduction should state whether kernel modifications
>>> +were necessary (e.g. inserting a delay to widen the race). The commit message
>>> +must disclose if error injection or loading a special kernel module was used
>>> +to trigger the issue. The reproduction steps should be included in the commit
>>> +message if they are short (roughly 10 lines or fewer); longer reproducers can
>>> +be posted online with a link included.
>>> +
>>> +The testing statement should explain whether the fix was tested against the
>>> +reproducer and against kernel selftests.
>>
>> We should probably also add that the commit message of a fix must
>> describe the impact to the user.
>>
>> FWIW the intention is that we'd either quote this text at people
>> until they comply or even get an AI bot looking at all patches coming
>> in and deciding if commit message is good enough. With some tuning
>> LLM should be able to check that the 4 items are covered.
> 
> I see what you're trying to do, but making regular contributors append
> 2 paragraphs to their commit messages (or ask their LLM to generate
> them, and also fight for an hour to get a reproducer that actually
> does something) just to check the box seems painful. Reading the git
> log with all this stuff mixed in will be worse.
> 
> As someone who's probably never sent a compliant patch, and who has a
> tendency to forget new rules (especially those that are inconvenient):
> meh. I don't think the commit messages we've been writing all this
> time have been so bad.

Are these rules mostly for new contributors using AI to generate
patches? I guess regular contributors are already applying these rules,
either by using a Reported-by tag, pasting a call trace, or describing
how the bug was discovered, no?

I find this important to understand how the bug was discovered, and ask
for a reproducer or another sort of proof when this is a "potential
issue found by an AI code review agent". Otherwise, that means the
reviewers have to do the validation, which will certainly take them
longer than the author to generate the patch.

I don't think regular contributors have to change their commit messages, no?

> OTOH maybe that's the only way to handle the volume of AI slop
> "fixes". 2 more paragraphs when the commit for a trivial 1-line fix is
> already 2 pages long doesn't make much difference.

:)

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Re: [RFC] docs: netdev: additional info requirements for bug fixes

[Sabrina Dubroca]

2026-07-28, 18:17:27 +0200, Matthieu Baerts wrote:
> Hi Sabrina, Jakub,
> 
> Thank you for the patch and the review!
> 
> On 28/07/2026 03:08, Sabrina Dubroca wrote:
> > 2026-07-27, 15:25:17 -0700, Jakub Kicinski wrote:
> >> On Mon, 27 Jul 2026 13:47:24 -0700 Jakub Kicinski wrote:
> >>> +All bug fixes must clearly state how the issue was discovered and validated,
> >>> +and how the fix was tested. This should be done in plain English, not with
> >>> +special tags or annotations.
> >>> +
> >>> +Example statements describing discovery:
> >>> +
> >>> +- discovered by a non-AI static analysis tool.
> >>> +- discovered by an AI code review agent.
> >>> +- discovered by manual code inspection.
> >>> +- triggered during code development.
> >>> +- triggered in CI testing.
> >>> +- observed on a machine in real use.
> >>> +
> >>> +If the issue was not observed in reality (e.g. it was caught by an AI tool
> >>> +or manual code inspection), the next sentence should describe the
> >>> +reproduction. The reproduction should state whether kernel modifications
> >>> +were necessary (e.g. inserting a delay to widen the race). The commit message
> >>> +must disclose if error injection or loading a special kernel module was used
> >>> +to trigger the issue. The reproduction steps should be included in the commit
> >>> +message if they are short (roughly 10 lines or fewer); longer reproducers can
> >>> +be posted online with a link included.
> >>> +
> >>> +The testing statement should explain whether the fix was tested against the
> >>> +reproducer and against kernel selftests.
> >>
> >> We should probably also add that the commit message of a fix must
> >> describe the impact to the user.
> >>
> >> FWIW the intention is that we'd either quote this text at people
> >> until they comply or even get an AI bot looking at all patches coming
> >> in and deciding if commit message is good enough. With some tuning
> >> LLM should be able to check that the 4 items are covered.
> > 
> > I see what you're trying to do, but making regular contributors append
> > 2 paragraphs to their commit messages (or ask their LLM to generate
> > them, and also fight for an hour to get a reproducer that actually
> > does something) just to check the box seems painful. Reading the git
> > log with all this stuff mixed in will be worse.
> > 
> > As someone who's probably never sent a compliant patch, and who has a
> > tendency to forget new rules (especially those that are inconvenient):
> > meh. I don't think the commit messages we've been writing all this
> > time have been so bad.
> 
> Are these rules mostly for new contributors using AI to generate
> patches?

Based on the commit message, I guess yes. Based on Jakub's reply, I
would say no.

> I guess regular contributors are already applying these rules,
> either by using a Reported-by tag, pasting a call trace, or describing
> how the bug was discovered, no?

Reported-by doesn't describe how the bug was discovered, just that it
was discovered by someone else than the author of the commit. It can
just as well be an AI report, CI testing, someone else's manual code
inspection, or a "real life" bug.

The call trace could have been produced by adding delays to help
trigger a race found by code inspection, or seen in real life but not
reproduced by the patch author.

I'm not sure code inspection vs some tool (AI or not) makes much
difference, at least when the patch submitter has enough experience to
check the output of the tool before writing/sending the patch.

Without checking git history, I suspect there's been a bunch of fixes
for issues found via code inspection or sparse that were not actually
triggered/reproduced. The code was obviously wrong, it gets fixed. AI
makes reproducers cheap(er), but not free (in both tokens and
prompting time).

"Impact to the user" is probably missing in most fixes I've sent (or
severely lacking, ie nothing more than UAF/memleak).
[a few examples: 52501989c762 cbada1048847 5502bc4746e8]

But I could see an argument for "well we should have started
mentioning testing and impact to user ages ago".

> I find this important to understand how the bug was discovered, and ask
> for a reproducer or another sort of proof when this is a "potential
> issue found by an AI code review agent". Otherwise, that means the
> reviewers have to do the validation, which will certainly take them
> longer than the author to generate the patch.

Sure.

> I don't think regular contributors have to change their commit messages, no?

If that's the case, good. But "quote this text at people until they
comply" and "get an AI bot looking at all patches coming in" doesn't
sound like that to me.

-- 
Sabrina

Re: [RFC] docs: netdev: additional info requirements for bug fixes

[Jakub Kicinski]

On Wed, 29 Jul 2026 00:56:31 +0200 Sabrina Dubroca wrote:
> 2026-07-28, 18:17:27 +0200, Matthieu Baerts wrote:
> > > I see what you're trying to do, but making regular contributors append
> > > 2 paragraphs to their commit messages (or ask their LLM to generate
> > > them, and also fight for an hour to get a reproducer that actually
> > > does something) just to check the box seems painful. Reading the git
> > > log with all this stuff mixed in will be worse.
> > > 
> > > As someone who's probably never sent a compliant patch, and who has a
> > > tendency to forget new rules (especially those that are inconvenient):
> > > meh. I don't think the commit messages we've been writing all this
> > > time have been so bad.  
> > 
> > Are these rules mostly for new contributors using AI to generate
> > patches?  
> 
> Based on the commit message, I guess yes. Based on Jakub's reply, I
> would say no.

Regular contributors sometimes also act on AI reports with no hard
proof. That said, it's always entirely okay to say "Found by code
analysis, and fix is untested." For regular contributors the reputation
will outweigh the testing. For everyone else we will ask them to test.

> > I guess regular contributors are already applying these rules,
> > either by using a Reported-by tag, pasting a call trace, or describing
> > how the bug was discovered, no?  
> 
> Reported-by doesn't describe how the bug was discovered, just that it
> was discovered by someone else than the author of the commit. It can
> just as well be an AI report, CI testing, someone else's manual code
> inspection, or a "real life" bug.
> 
> The call trace could have been produced by adding delays to help
> trigger a race found by code inspection, or seen in real life but not
> reproduced by the patch author.
> 
> I'm not sure code inspection vs some tool (AI or not) makes much
> difference, at least when the patch submitter has enough experience to
> check the output of the tool before writing/sending the patch.

Fair, I couldn't think of an intuitive category which would cover both.

> Without checking git history, I suspect there's been a bunch of fixes
> for issues found via code inspection or sparse that were not actually
> triggered/reproduced. The code was obviously wrong, it gets fixed. AI
> makes reproducers cheap(er), but not free (in both tokens and
> prompting time).
> 
> "Impact to the user" is probably missing in most fixes I've sent (or
> severely lacking, ie nothing more than UAF/memleak).
> [a few examples: 52501989c762 cbada1048847 5502bc4746e8]
> 
> But I could see an argument for "well we should have started
> mentioning testing and impact to user ages ago".
> 
> > I find this important to understand how the bug was discovered, and ask
> > for a reproducer or another sort of proof when this is a "potential
> > issue found by an AI code review agent". Otherwise, that means the
> > reviewers have to do the validation, which will certainly take them
> > longer than the author to generate the patch.  
> 
> Sure.
> 
> > I don't think regular contributors have to change their commit messages, no?  

Not tomorrow, but I'd hope the ask is not too onerous?

> If that's the case, good. But "quote this text at people until they
> comply" and "get an AI bot looking at all patches coming in" doesn't
> sound like that to me.

IMO it's really very useful for reviewers to know if the author
triggered the issue. Also, for downstream backporters it's useful 
to know in case of conflict whether to invest time in resolving
or the patch is mostly theoretical and waiting until next major is fine.

I'm also guilty of not adding "impact to the user" info, but that
requires thinking and theorizing. The ask here is to purely state
the facts.

FWIW the immediate trigger for me is the people who started sending
sloppy fixes to drivers that nobody uses. I ask them about the
discovery process and half of the time they don't even respond.

Re: [RFC] docs: netdev: additional info requirements for bug fixes

[Sabrina Dubroca]

2026-07-28, 16:08:20 -0700, Jakub Kicinski wrote:
> On Wed, 29 Jul 2026 00:56:31 +0200 Sabrina Dubroca wrote:
> > If that's the case, good. But "quote this text at people until they
> > comply" and "get an AI bot looking at all patches coming in" doesn't
> > sound like that to me.
> 
> IMO it's really very useful for reviewers to know if the author
> triggered the issue.

People usually add that information if they did. If it's not present,
we should assume they didn't, and treat it as belonging to the "AI
report/other-tool report/code analysis" bucket?

> Also, for downstream backporters it's useful 
> to know in case of conflict whether to invest time in resolving
> or the patch is mostly theoretical and waiting until next major is fine.

For downstream backports, there can be a number of differences that
make an issue either easier or harder/impossible to trigger. But sure,
that's a useful baseline.


If we could reword the statement to include something like (with a
formulation/presentation similar to your patch, this is a short/ugly
version):

Fixes should describe if and how the issue was triggered/reproduced.
This information should describe how likely it is to happen in real
life [stuff about delays/fault injection/etc]. If this information is
missing, we WILL assume the bug was found through code analysis
(whether by human or tool/AI) and not actually triggered on a live
system.
[something about such patches being penalized in the reviews/queue?
I don't know]


my concern about having to add a bunch of uninformative text would go
away.

> I'm also guilty of not adding "impact to the user" info, but that
> requires thinking and theorizing. The ask here is to purely state
> the facts.

So just something like "possible UAF/memleak/deadlock/some unwanted
behavior" is what you expect here? That's totally reasonable. I
thought you meant something more abstract.

> FWIW the immediate trigger for me is the people who started sending
> sloppy fixes to drivers that nobody uses. I ask them about the
> discovery process and half of the time they don't even respond.

Sure, I get that, you're drowning in pointless slop.

An alternative could be an AI bot that looks at "fixes" and checks if
they're likely to ever happen (or have a measurable impact. a tiny
memleak when a device is initialized/module is loaded, even with great
reproduction steps in the commit message, still falls in the "don't
care" category IMO). My experiments with "find a way to trigger this
code path" have been pretty good, so I guess if the bot comes up with
"basically can't happen", that would be fairly reliable.

-- 
Sabrina

Re: [RFC] docs: netdev: additional info requirements for bug fixes

[Jakub Kicinski]

On Thu, 30 Jul 2026 16:12:35 +0200 Sabrina Dubroca wrote:
> 2026-07-28, 16:08:20 -0700, Jakub Kicinski wrote:
> > On Wed, 29 Jul 2026 00:56:31 +0200 Sabrina Dubroca wrote:  
> > > If that's the case, good. But "quote this text at people until they
> > > comply" and "get an AI bot looking at all patches coming in" doesn't
> > > sound like that to me.  
> > 
> > IMO it's really very useful for reviewers to know if the author
> > triggered the issue.  
> 
> People usually add that information if they did. If it's not present,
> we should assume they didn't, and treat it as belonging to the "AI
> report/other-tool report/code analysis" bucket?

The ask is for info about discovery, repro, test.
The sentence you quoted is about repro, you seem to be talking
about tool.

I think all 3 pieces of info (discovery, repro, test env) are valuable.

> > Also, for downstream backporters it's useful 
> > to know in case of conflict whether to invest time in resolving
> > or the patch is mostly theoretical and waiting until next major is fine.  
> 
> For downstream backports, there can be a number of differences that
> make an issue either easier or harder/impossible to trigger. But sure,
> that's a useful baseline.
> 
> 
> If we could reword the statement to include something like (with a
> formulation/presentation similar to your patch, this is a short/ugly
> version):
> 
> Fixes should describe if and how the issue was triggered/reproduced.
> This information should describe how likely it is to happen in real
> life [stuff about delays/fault injection/etc].

Here we'd ask the author to judge likelihood. Which is hard and takes
effort. My goal was to ask for pure information, no thinking effort.

> If this information is
> missing, we WILL assume the bug was found through code analysis
> (whether by human or tool/AI) and not actually triggered on a live
> system.
> [something about such patches being penalized in the reviews/queue?
> I don't know]
> 
> 
> my concern about having to add a bunch of uninformative text would go
> away.

I feel bad enough accusing people of using LLMs (even when they
_obviously_ do). I don't want to accuse people of not testing their
fixes based on information missing :( I'd rather first ask them
to add such info explicitly and then shout at them :)

> > I'm also guilty of not adding "impact to the user" info, but that
> > requires thinking and theorizing. The ask here is to purely state
> > the facts.  
> 
> So just something like "possible UAF/memleak/deadlock/some unwanted
> behavior" is what you expect here? That's totally reasonable. I
> thought you meant something more abstract.

Right, my patch doesn't ask for impact specifically.
But the direction is right - ask for info the author already has rather
than require the author to theorize about likelihood and impact, or
do extra experiments.

> > FWIW the immediate trigger for me is the people who started sending
> > sloppy fixes to drivers that nobody uses. I ask them about the
> > discovery process and half of the time they don't even respond.  
> 
> Sure, I get that, you're drowning in pointless slop.
> 
> An alternative could be an AI bot that looks at "fixes" and checks if
> they're likely to ever happen (or have a measurable impact. a tiny
> memleak when a device is initialized/module is loaded, even with great
> reproduction steps in the commit message, still falls in the "don't
> care" category IMO). My experiments with "find a way to trigger this
> code path" have been pretty good, so I guess if the bot comes up with
> "basically can't happen", that would be fairly reliable.

Yes, definitely planning to do that too (once I figure out how 
to squeeze some free tokens out of the current pipeline :/)

Still, I'd also like to ask the author.

Re: [RFC] docs: netdev: additional info requirements for bug fixes

[Sabrina Dubroca]

2026-07-30, 13:50:27 -0700, Jakub Kicinski wrote:
> On Thu, 30 Jul 2026 16:12:35 +0200 Sabrina Dubroca wrote:
> > 2026-07-28, 16:08:20 -0700, Jakub Kicinski wrote:
> > > On Wed, 29 Jul 2026 00:56:31 +0200 Sabrina Dubroca wrote:  
> > > > If that's the case, good. But "quote this text at people until they
> > > > comply" and "get an AI bot looking at all patches coming in" doesn't
> > > > sound like that to me.  
> > > 
> > > IMO it's really very useful for reviewers to know if the author
> > > triggered the issue.  
> > 
> > People usually add that information if they did. If it's not present,
> > we should assume they didn't, and treat it as belonging to the "AI
> > report/other-tool report/code analysis" bucket?
> 
> The ask is for info about discovery, repro, test.
> The sentence you quoted is about repro, you seem to be talking
> about tool.
>
> I think all 3 pieces of info (discovery, repro, test env) are valuable.

I'm just trying to find some space for bad memory (I still can't
remember to add "CC: stable" to my patches much of the time) and not
bloating the commit messages.

[on the "talking about tool" thing] If the information you want is
missing, handle the patch /as if/ it was the lowest class in each area
(because it probably is). That happens to be (I think) "no repro, not
tested (or just selftests, does that deserve a mention?), found by
some tool or human code review". That's why I mentioned "tool".

And I think they kind of mesh together. If it's been discovered with a
crash in production, it's "more reproduced" than just code analysis,
but actual reproduction for testing purposes may be impossible without
hacks. syzbot has probably generated repros for issues that will
rarely be hit live.

> > > Also, for downstream backporters it's useful 
> > > to know in case of conflict whether to invest time in resolving
> > > or the patch is mostly theoretical and waiting until next major is fine.  
> > 
> > For downstream backports, there can be a number of differences that
> > make an issue either easier or harder/impossible to trigger. But sure,
> > that's a useful baseline.
> > 
> > 
> > If we could reword the statement to include something like (with a
> > formulation/presentation similar to your patch, this is a short/ugly
> > version):
> > 
> > Fixes should describe if and how the issue was triggered/reproduced.
> > This information should describe how likely it is to happen in real
> > life [stuff about delays/fault injection/etc].
> 
> Here we'd ask the author to judge likelihood. Which is hard and takes
> effort. My goal was to ask for pure information, no thinking effort.

No, sorry, this was meant to be a reference to what you wrote:

    The reproduction should state whether kernel modifications were
    necessary (e.g. inserting a delay to widen the race). The commit
    message must disclose if error injection or loading a special
    kernel module was used to trigger the issue.

> 
> > If this information is
> > missing, we WILL assume the bug was found through code analysis
> > (whether by human or tool/AI) and not actually triggered on a live
> > system.
> > [something about such patches being penalized in the reviews/queue?
> > I don't know]
> > 
> > 
> > my concern about having to add a bunch of uninformative text would go
> > away.
> 
> I feel bad enough accusing people of using LLMs (even when they
> _obviously_ do). I don't want to accuse people of not testing their
> fixes based on information missing :( I'd rather first ask them
> to add such info explicitly and then shout at them :)

Then they can add the information. Their LLM will probably generate
the things you want if the doc says "patches without the info will be
penalized". (or they'll start claiming it's been hit in production? I
don't know if those things are good at lying. but the humans might, so
I could see the drawback to this idea... or the LLMs will burn a
zillion tokens to generate a reproducer?)

I don't think "Found while reading some code. Nope, I haven't bothered
using fault injection to try to trigger this." is valuable at all
(other than maybe saying "I found that without AI!"), and I'd prefer
not having to add this/not having to read this in git history.

(I've probably spent more time arguing about this than I'll ever spend
adding this stuff to my patches :) Well, not if you count the times
I'll have to send "ugh sorry I forgot again" :))


> > > I'm also guilty of not adding "impact to the user" info, but that
> > > requires thinking and theorizing. The ask here is to purely state
> > > the facts.  
> > 
> > So just something like "possible UAF/memleak/deadlock/some unwanted
> > behavior" is what you expect here? That's totally reasonable. I
> > thought you meant something more abstract.
> 
> Right, my patch doesn't ask for impact specifically.
> But the direction is right - ask for info the author already has rather
> than require the author to theorize about likelihood and impact, or
> do extra experiments.

Agree. I just misinterpreted what you meant by "impact".

-- 
Sabrina