bpf_prog_create_from_user(9)

💖 bpf_prog_create_from_user — the kernel API manual, bestie edition 💖

okay so like… welcome to the Kernel API Manual entry for bpf_prog_create_from_user(9), and yes I'm gonna hold your hand through the whole thing 🫶

---

✨ NAME ✨

bpf_prog_create_from_user — it makes an unattached filter out of a buffer that came from user space. that's the whole vibe. 💅

---

🌸 SYNOPSIS 🌸

int bpf_prog_create_from_user (struct bpf_prog **pfp , struct sock_fprog
*fprog , bpf_aux_classic_check_t trans , bool save_orig );

literally copy that exactly, do not retype it from memory, I will find out 😭

---

🎀 ARGUMENTS 🎀

• pfp — this is the unattached filter that gets created. it's a struct bpf_prog **, so you're handing over a pointer-to-pointer and letting the function fill it in. main character energy tbh 👑
• fprog — the filter program itself, as a struct sock_fprog *. this is the actual program, not the built filter. two different things, don't mix them up bestie 💀
• trans — the post-classic verifier transformation handler, typed bpf_aux_classic_check_t. yes, post-classic. yes, verifier. yes, transformation. it's giving very specific 🌈
• save_orig — a bool that says whether to save the classic BPF program. true means save it, false means don't. groundbreaking, I know 🦋

---

⭐ DESCRIPTION ⭐

so this function effectively does the same as bpf_prog_create — like, that's the whole point, iykyk — except for one iconic little twist: it builds up its insns buffer from a buffer that user space provides. so yeah, user-supplied insns. that's the difference. periodt. 🔥

and it also lets you pass in a bpf_aux_classic_check_t handler, which is the trans argument from up top in case you forgot (I didn't forget, I never forget 💅). that handler is the post-classic verifier transformation handler, and it gets to do its thing as part of all this.

---

🔍 SEE ALSO 🔍

okay so the kernel file to look at is ./net/core/filter.c — go read it, it's right there, no cap. and while you're in the neighborhood, here's the whole squad of related pages:

• sk_filter_trim_cap(9)
• bpf_convert_filter(9)
• bpf_check_classic(9)
• sk_filter_release_rcu(9)
• sk_filter_release(9)
• bpf_prog_create(9)
• sk_attach_filter(9)
• xdp redirect(9)
• bpf_skb_meta_pointer(9)
• bpf_dynptr_from_skb_meta(9)
• bpf_xdp_pull_data(9)
• bpf_icmp_send(9)

that's twelve (12) references, all of them, I counted, you're welcome 🍓

---

heads up bestie: the buffer for the insns comes from user space, which is exactly why there's a classic verifier and a post-classic transformation handler in the mix. don't be out here trusting raw user buffers, that's not the vibe 🙈

---

and that's the page!! 💖✨🎀 this one lives in the kernel source tree at ./net/core, dated October 2026, and it goes by bpf_prog_create_from_user(9). mwah, go build something iconic 🧚💜