Instead of submitting patches with known bugs, the UMN researcher could have done a retrospective study of patches from other kernel developers containing bugs that were later found and fixed. Not only was he acting in bad faith, he was stupid.
There was also a high degree of arrogance on his part. That he thought his needs and priorities outweigh those of the much, much bigger community and/or that he doesn't need permission from anyone in charge of the codebase is just astounding.
Only looking at patches that were later found and fixed would not be measuring the same thing as what they were doing.
Not saying what they were doing was in any way ok, but I do doubt there's any way to measure what they were trying to measure without deliberately introducing bugs into some sort of review stream. Merely using observational data would produce results that are approximately as useful as those of every other observational design. (to wit: not very)
If you're filing a patch with a pattern you think will get by the review process, why not look to see if that pattern already existed in the code? That would give you the same information and you're potentially uncovering zero days instead of creating them, assuming those issues haven't already been fixed.
The researcher also could have coordinated with Linux and other Linux leads, so they know which patches will be "bad". They all want the Linux review process to produce high quality code and could have suggested other ways to test the process.
This seems ideal, but Linus would probably have accurately pointed out that it's already well-known that it wouldn't be hard for a malicious actor to insert bad code, so there's nothing really to be learnt here, at the cost of wasting the time of reviewers who are already overwhelmed.
Alternatively, I think the research could be done in an isolated experiment environment among consented participants. For example, they could ask maintainers to review some set of patches outside the context of Linux kernel. They would then ask maintainers opinions on the said patches using some form of questionnaires. If the participants are well informed the nature of the experiments, there would not be any ethic concerns. For incentive, the researchers could pay for any maintainers willing to participate the experiments.
