On Mon, Oct 12, 2026 at 09:02:46PM -0700, Kees Cook wrote:
On Mon, Oct 12, 2026 at 05:34:51PM -0400, Sasha Levin wrote:
A bug fixed in one place often exists elsewhere, in copied code, sibling
drivers, or other users of the same interface, and reviewers routinely
ask whether that was checked. Add a read-only procedure that states the
defect as a rule, searches for it through shared interfaces, copied
code, the introducing series, Coccinelle patterns and earlier fixes,
and verifies each candidate before reporting it.
Isn't this a basic software engineering skill? I'd expect this to be in
any agent's existing model, but okay, there's some Linux-specific aiming
in this skill (duplicated drivers, etc).
This actually comes from a local rig I have to teach it to use tools like
Coccinelle for these tasks instead of going on a 10 hour, 50 million token
adventure auditing our entire set of drivers in the kernel :)
I'd still prefer that this documentation, which we don't really have
anywhere else in the tree that I'm aware of, should be in a human area,
with the skill referencing it instead of duplicating it.
Ack. Let me think about this.
--
Thanks,
Sasha
