tests: runtime: Fix errors of incompatible types for in_ebpf tests

[cosmo0920]

This error was occurred in Ubuntu 26.04 (Resolute Raccoon).
Ubuntu Reolute's gcc is now gcc-15!!!

% gcc --version
gcc (Ubuntu 15.2.0-16ubuntu1) 15.2.0
Copyright (C) 2025 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Summary

Two compile errors in the in_ebpf runtime tests, both type mismatches against the plugin's event structs. Both fixed and verified.

1. strlen on a 2D array — tests/runtime/in_ebpf_exec_handler.c:144

struct execve_event.argv is char argv[EXECVE_ARG_MAX][EXECVE_ARG_LEN] plugins/in_ebpf/traces/includes/common/events.h:71, so bare .argv decays to char (*)[256], not char *. The adjacent strncmp already indexed argv[0]; only the strlen was missing it.

strlen(original->details.execve.argv[0])

2. Wrong struct passed to encode_sched_event — tests/runtime/in_ebpf_sched_handler.c, tests/runtime/in_ebpf_sched_handler.c

The sched handler takes the compact struct sched_sample plugins/in_ebpf/traces/includes/common/events.h — flat {type, common, sched_event details} — not the tagged-union struct event. Switched the test to sched_sample, which also meant details.sched.X → details.X:

• verify_decoded_values signature (line 89)
• field reads in the verify loop (lines 104–115)
• test_event declaration + memset size (lines 123, 129)
• field writes (lines 135–142)

Verification

Swept all seven in_ebpf_*_handler tests for the same mismatch class rather than just the two reported. All compile clean and pass:

bind PASS · exec PASS · malloc PASS · openssl PASS · sched PASS · signal PASS · tcp PASS

Left alone: -Wdiscarded-qualifiers warnings at handler.c, plugins/in_ebpf/traces/exec/handler.c — flb_log_event_encoder_append_cstring takes char * while the handler passes const char *. Pre-existing, warnings only, unrelated to either error.

---

Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

• Example configuration file for the change
• Debug log output from testing the change

• Attached Valgrind output that shows no leaks or memory corruption was found

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

• Run local packaging test showing all targets (including any new ones) build.
• Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

• Documentation required for this feature

Backporting

• Backport to latest stable release.

---

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

Summary by CodeRabbit

• Tests
  • Updated runtime validation for exec events to check the first command-line argument.
  • Updated scheduler event tests to use the current event structure and field layout.
  • Preserved coverage for CPU, process, and other scheduler-specific event details.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: af181b7a-e6a6-4ae9-9c0c-1fbd9dbaff80

📥 Commits

Reviewing files that changed from the base of the PR and between d46750c and 7c2a125.

📒 Files selected for processing (2)

• tests/runtime/in_ebpf_exec_handler.c
• tests/runtime/in_ebpf_sched_handler.c

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The runtime tests now match the current event data layouts. The exec test checks execve.argv[0], and the sched test uses struct sched_sample with flat sched detail fields.

Changes

Runtime decoding tests

Layer / File(s)	Summary
Execve argument validation tests/runtime/in_ebpf_exec_handler.c	The test checks the length of the first argument through execve.argv[0].
Sched sample layout and field validation tests/runtime/in_ebpf_sched_handler.c	The test uses struct sched_sample and reads and populates sched fields through flat details.* members.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 7c2a1

This change corrects incompatible types in runtime tests without changing production behavior, and the affected tests compile and pass; no actionable merge-blocking risk remains beyond normal checks.

Suggested reviewers: edsiper, leonardo-albertovich

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately identifies fixes for incompatible types in the in_ebpf runtime tests, which is the main change.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cosmo0920-plug-incompatible-pointer-type-errors-on-in_ebpf

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}