bpf_rbtree_add(9)

💖 bpf_rbtree_add(9) — aka the Kernel API Manual glow-up 🎀

okay so bestie, you know how I'm literally always talking about BPF and nobody listens? today we're talking about bpf_rbtree_add — yes she's a kernel API manual page, yes she's iconic, and yes I'm gonna explain her to you like we're on facetime at 2am. no cap. ✨

---

🌸 NAME 🌸

bpf_rbtree_add — adds a node to a BPF rbtree, slay 💅

---

🦋 SYNOPSIS 🦋

__bpf_kfunc int bpf_rbtree_add (struct bpf_rb_root *root , struct
bpf_rb_node *node , bool (less)(struct bpf_rb_node *a, const struct
bpf_rb_node *b) , struct btf_struct_meta *meta , u64 off );

like, that's the whole signature, take it in. five whole arguments. she's high maintenance but worth it 🫶

---

✨ ARGUMENTS ✨

okay so here's the cast of characters, main character energy from all five of them:

• root — the tree root. the mothership. the whole vibe starts here 🌳
• node — the node you're inserting. this is the girlypop actually getting added to the tree 🎀
• less — the comparator used to order nodes. she decides who comes before who, like a very fair, very logical group chat moderator ⭐
• meta — verifier-supplied struct metadata. you don't touch this, bestie, the verifier handles it 🙈
• off — verifier-supplied offset of node within the containing object. same deal, not yours to set 💀

---

💜 DESCRIPTION 💜

Insert node into root using less. that's it, that's the whole job. she does one thing and she does it well 👑

real talk though: the verifier rewrites meta and off — BPF programs do not set them. do not come for those parameters, they are not for you, they are spoken for. lowkey this is the most important sentence on the page fr fr 😭

---

🔥 RETURN 🔥

• 0 on success — we love a win, we celebrate a win 🎉
• -EINVAL if node is already linked in a tree — like girl, she's already in a tree, you can't just insert her again. that's not how any of this works. not me finding out the hard way 💅

---

🌈 SEE ALSO 🌈

okay this section is a whole friend group, buckle up:

Kernel file ./kernel/bpf/helpers.c

bpf_obj_new(9), bpf_percpu_obj_new(9), bpf_obj_drop(9), bpf_percpu_obj_drop(9), bpf_refcount_acquire(9), bpf_list_push_front(9), bpf_list_push_back(9), bpf_task_acquire(9), bpf_task_release(9), bpf_cgroup_acquire(9), bpf_cgroup_release(9), bpf_cgroup_ancestor(9), bpf_cgroup_from_id(9), bpf_task_under_cgroup(9), bpf_task_get_cgroup1(9), bpf_task_from_pid(9), bpf_task_from_vpid(9), bpf_dynptr_slice(9), bpf_dynptr_slice_rdwr(9), bpf_dynptr_copy(9), bpf_dynptr_memset(9), bpf_iter_bits_new(9), bpf_iter_bits_next(9), bpf_iter_bits_destroy(9), bpf_copy_from_user_str(9), bpf_copy_from_user_task_str(9), bpf_strcmp(9), bpf_strcasecmp(9), bpf_strnchr(9), bpf_strchr(9), bpf_strchrnul(9), bpf_strrchr(9), bpf_strnlen(9), bpf_strlen(9), bpf_strspn(9), bpf_strcspn(9), bpf_strstr(9), bpf_strcasestr(9), bpf_strnstr(9), bpf_strncasestr(9), bpf_lookup_user_key(9), bpf_lookup_system_key(9), bpf_key_put(9), bpf_verify_pkcs7_signature(9), bpf_task_work_schedule_signal(9), bpf_task_work_schedule_resume(9), bpf_timer_cancel_async(9)

like okay that's a lot of besties but they're all valid, iykyk 🧚

---

and that's the page!! 💖 she lives in the kernel source under ./kernel/bpf, dated October 2026 — so like, keep an eye out for her, she's out there thriving. go forth and insert your nodes responsibly, bestie. periodt. 🌸🦋💅