bpf_strcasestr(9)

💅 bpf_strcasestr 💅

okay so this is a page from the Kernel API Manual (section 9, kernel API, iykyk), and it's all about bpf_strcasestr — the function that finds the first substring in a string while ignoring the case of the characters. literally the "i don't care if you're shouting" version of a substring search 🫶

---

✨ NAME ✨

bpf_strcasestr — find the first substring in a string, ignoring the case of the characters 💖

---

🎀 SYNOPSIS 🎀

__bpf_kfunc int bpf_strcasestr (const char *s1__ign , const char *s2__ign );

that's the whole signature bestie, no cap. two const char * args, both marked __ign, returns an int, and it's a __bpf_kfunc 👑

---

🌸 ARGUMENTS 🌸

• s1__ign — the string to be searched. this is the one you're digging through, the main character of the search 🔍
• s2__ign — the string to search for. the little guy you're looking for inside s1__ign 🐣

---

🌈 RETURN 🌈

here's the vibe check on what you get back — it's an int, so read the sign, okay?

• >=0 — index of the first character of the first occurrence of s2__ign within s1__ign ⭐ (zero or bigger = found it, and here's exactly where it starts)
• -ENOENT — s2__ign is not a substring of s1__ign 😭 (it's just not in there, sorry bestie)
• -EFAULT — cannot read one of the strings 🙈 (something's not readable)
• -E2BIG — one of the strings is too large 💀 (that string ate and then ate some more)
• -ERANGE — one of the strings is outside of kernel address space 🚫 (not our address space, not our problem)

fr fr, check the return value every time. 0 and up is a hit, negative is a hard no — and each negative has a different reason, so don't lump them together 💅

---

🦋 SEE ALSO 🦋

so many friends 💖 first up, the kernel file: ./kernel/bpf/helpers.c — that's where the family lives. then, the whole crew:

• bpf_obj_new(9)
• bpf_percpu_obj_new(9)
• bpf_obj_drop(9)
• bpf_percpu_obj_drop(9)
• bpf_refcount_acquire(9)
• bpf_list_push_front(9)
• bpf_list_push_back(9)
• bpf_rbtree_add(9)
• bpf_task_acquire(9)
• bpf_task_release(9)
• bpf_cgroup_acquire(9)
• bpf_cgroup_release(9)
• bpf_cgroup_ancestor(9)
• bpf_cgroup_from_id(9)
• bpf_task_under_cgroup(9)
• bpf_task_get_cgroup1(9)
• bpf_task_from_pid(9)
• bpf_task_from_vpid(9)
• bpf_dynptr_slice(9)
• bpf_dynptr_slice_rdwr(9)
• bpf_dynptr_copy(9)
• bpf_dynptr_memset(9)
• bpf_iter_bits_new(9)
• bpf_iter_bits_next(9)
• bpf_iter_bits_destroy(9)
• bpf_copy_from_user_str(9)
• bpf_copy_from_user_task_str(9)
• bpf_strcmp(9)
• bpf_strcasecmp(9)
• bpf_strnchr(9)
• bpf_strchr(9)
• bpf_strchrnul(9)
• bpf_strrchr(9)
• bpf_strnlen(9)
• bpf_strlen(9)
• bpf_strspn(9)
• bpf_strcspn(9)
• bpf_strstr(9)
• bpf_strnstr(9)
• bpf_strncasestr(9)
• bpf_lookup_user_key(9)
• bpf_lookup_system_key(9)
• bpf_key_put(9)
• bpf_verify_pkcs7_signature(9)
• bpf_task_work_schedule_signal(9)
• bpf_task_work_schedule_resume(9)
• bpf_timer_cancel_async(9)

the string-search girlies in particular — bpf_strstr(9), bpf_strnstr(9), bpf_strcasecmp(9), bpf_strncasestr(9) — are literally siblings of this one, so go say hi 🌸

---

that's the whole page bestie, no notes 💅 this one ships out of ./kernel/bpf and it's dated October 2026 — mwah, go find your substrings 🎀✨🫶