bpf_strstr(9)

💖 bpf_strstr — Kernel API Manual ✨

ok so bestie, welcome to the bpf_strstr(9) page!! this is the kernel API manual, and honestly? it's giving "find your fave substring" energy and i'm obsessed. lowkey essential if you're doing string stuff in BPF. let's get into it 🫶

---

🌸 NAME 🌸

bpf_strstr — find the first substring in a string. literally exactly what it says on the tin, no cap 💅

---

✨ SYNOPSIS ✨

__bpf_kfunc int bpf_strstr (const char *s1__ign , const char *s2__ign );

like, that's the whole vibe. two strings walk in, one index walks out 🔥

---

🎀 ARGUMENTS 🎀

• s1__ign — the string you're searching in, aka the main character 🌟
• s2__ign — the string you're searching for, aka the one you're looking for in the crowd 🔍

---

🦋 RETURN 🦋

ok so here's the vibe check on what you get back:

• >=0 — index of the first character of the first occurrence of s2__ign within s1__ign. found it, slay!! 🎉
• -ENOENT — s2__ign is not a substring of s1__ign. it's not there bestie, it's not there 😭
• -EFAULT — cannot read one of the strings. rip, the string said "no ❤️" 🙈
• -E2BIG — one of the strings is too large. too much text, too much drama 💀
• -ERANGE — one of the strings is outside of kernel address space. wrong neighbourhood fr fr 🚫

---

💜 SEE ALSO 💜

so many frens in the kernel file ./kernel/bpf/helpers.c — go say hi to all of them:

bpf_obj_new(9), bpf_percpu_obj_new(9), bpf_obj_drop(9), bpf_percpu_obj_drop(9), bpf_refcount_acquire(9), bpf_list_push_front(9), bpf_list_push_back(9), bpf_rbtree_add(9), bpf_task_acquire(9), bpf_task_release(9), bpf_cgroup_acquire(9), bpf_cgroup_release(9), bpf_cgroup_ancestor(9), bpf_cgroup_from_id(9), bpf_task_under_cgroup(9), bpf_task_get_cgroup1(9), bpf_task_from_pid(9), bpf_task_from_vpid(9), bpf_dynptr_slice(9), bpf_dynptr_slice_rdwr(9), bpf_dynptr_copy(9), bpf_dynptr_memset(9), bpf_iter_bits_new(9), bpf_iter_bits_next(9), bpf_iter_bits_destroy(9), bpf_copy_from_user_str(9), bpf_copy_from_user_task_str(9), bpf_strcmp(9), bpf_strcasecmp(9), bpf_strnchr(9), bpf_strchr(9), bpf_strchrnul(9), bpf_strrchr(9), bpf_strnlen(9), bpf_strlen(9), bpf_strspn(9), bpf_strcspn(9), bpf_strcasestr(9), bpf_strnstr(9), bpf_strncasestr(9), bpf_lookup_user_key(9), bpf_lookup_system_key(9), bpf_key_put(9), bpf_verify_pkcs7_signature(9), bpf_task_work_schedule_signal(9), bpf_task_work_schedule_resume(9), bpf_timer_cancel_async(9)

---

ok that's the whole page bestie, go forth and find those substrings 💅✨ this one's from the ./kernel/bpf corner of the kernel, dated October 2026 — mwah, bye!! 🎀🫶