Re: [RFC] docs: netdev: additional info requirements for bug fixes

[Sabrina Dubroca <sd@queasysnail.net>]

2026-07-28, 18:17:27 +0200, Matthieu Baerts wrote:
> Hi Sabrina, Jakub,
> 
> Thank you for the patch and the review!
> 
> On 28/07/2026 03:08, Sabrina Dubroca wrote:
> > 2026-07-27, 15:25:17 -0700, Jakub Kicinski wrote:
> >> On Mon, 27 Jul 2026 13:47:24 -0700 Jakub Kicinski wrote:
> >>> +All bug fixes must clearly state how the issue was discovered and validated,
> >>> +and how the fix was tested. This should be done in plain English, not with
> >>> +special tags or annotations.
> >>> +
> >>> +Example statements describing discovery:
> >>> +
> >>> +- discovered by a non-AI static analysis tool.
> >>> +- discovered by an AI code review agent.
> >>> +- discovered by manual code inspection.
> >>> +- triggered during code development.
> >>> +- triggered in CI testing.
> >>> +- observed on a machine in real use.
> >>> +
> >>> +If the issue was not observed in reality (e.g. it was caught by an AI tool
> >>> +or manual code inspection), the next sentence should describe the
> >>> +reproduction. The reproduction should state whether kernel modifications
> >>> +were necessary (e.g. inserting a delay to widen the race). The commit message
> >>> +must disclose if error injection or loading a special kernel module was used
> >>> +to trigger the issue. The reproduction steps should be included in the commit
> >>> +message if they are short (roughly 10 lines or fewer); longer reproducers can
> >>> +be posted online with a link included.
> >>> +
> >>> +The testing statement should explain whether the fix was tested against the
> >>> +reproducer and against kernel selftests.
> >>
> >> We should probably also add that the commit message of a fix must
> >> describe the impact to the user.
> >>
> >> FWIW the intention is that we'd either quote this text at people
> >> until they comply or even get an AI bot looking at all patches coming
> >> in and deciding if commit message is good enough. With some tuning
> >> LLM should be able to check that the 4 items are covered.
> > 
> > I see what you're trying to do, but making regular contributors append
> > 2 paragraphs to their commit messages (or ask their LLM to generate
> > them, and also fight for an hour to get a reproducer that actually
> > does something) just to check the box seems painful. Reading the git
> > log with all this stuff mixed in will be worse.
> > 
> > As someone who's probably never sent a compliant patch, and who has a
> > tendency to forget new rules (especially those that are inconvenient):
> > meh. I don't think the commit messages we've been writing all this
> > time have been so bad.
> 
> Are these rules mostly for new contributors using AI to generate
> patches?

Based on the commit message, I guess yes. Based on Jakub's reply, I
would say no.

> I guess regular contributors are already applying these rules,
> either by using a Reported-by tag, pasting a call trace, or describing
> how the bug was discovered, no?

Reported-by doesn't describe how the bug was discovered, just that it
was discovered by someone else than the author of the commit. It can
just as well be an AI report, CI testing, someone else's manual code
inspection, or a "real life" bug.

The call trace could have been produced by adding delays to help
trigger a race found by code inspection, or seen in real life but not
reproduced by the patch author.

I'm not sure code inspection vs some tool (AI or not) makes much
difference, at least when the patch submitter has enough experience to
check the output of the tool before writing/sending the patch.

Without checking git history, I suspect there's been a bunch of fixes
for issues found via code inspection or sparse that were not actually
triggered/reproduced. The code was obviously wrong, it gets fixed. AI
makes reproducers cheap(er), but not free (in both tokens and
prompting time).

"Impact to the user" is probably missing in most fixes I've sent (or
severely lacking, ie nothing more than UAF/memleak).
[a few examples: 52501989c762 cbada1048847 5502bc4746e8]

But I could see an argument for "well we should have started
mentioning testing and impact to user ages ago".

> I find this important to understand how the bug was discovered, and ask
> for a reproducer or another sort of proof when this is a "potential
> issue found by an AI code review agent". Otherwise, that means the
> reviewers have to do the validation, which will certainly take them
> longer than the author to generate the patch.

Sure.

> I don't think regular contributors have to change their commit messages, no?

If that's the case, good. But "quote this text at people until they
comply" and "get an AI bot looking at all patches coming in" doesn't
sound like that to me.

-- 
Sabrina