在为 gdb 打开套接字之前，pin 进程崩溃

Question

当我使用我的自定义 pin-tool 运行 Intel pin 时，由于某种原因，它在段错误中崩溃，甚至在启动被测应用程序之前。它发生在一个应用程序上，即使相同的设置适用于另一个应用程序。

这是一个成功运行的例子：

$ unset HOME && TEST_FILE=test000001.test pin -appdebug -t /home/necto/pin-trace.so -- ./executable1 <args to the executable>
Application stopped until continued from debugger.
Start GDB, then issue this command at the (gdb) prompt:
  target remote :42312

（unset HOME 是为了应用程序的缘故）这是一个不成功的运行示例：

$ unset HOME && TEST_FILE=test000001.test pin -appdebug -t /home/necto/pin-trace.so -- ./executable2 <args to the executable>
C: Tool (or Pin) caused signal 11 at PC 0x000000000
Segmentation fault

注意，它甚至没有打开一个套接字供 gdb 附加到。

当直接在 gdb 下运行时，它的失败似乎有所不同（在 SIGUSR1 上）：

$ unset HOME && TEST_FILE=test000001.test gdb --args pin -appdebug -t /home/necto/pin-trace.so -- ./executable2 <args to the executable>
GNU gdb (Ubuntu 7.11.1-0ubuntu1~16.5) 7.11.1
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from pin...(no debugging symbols found)...done.
(gdb) r
Starting program: /home/necto/pin/pin -appdebug -t /home/necto/pin-trace.so -- ./executable2 <args to the executable>
process 185838 is executing new program: /home/necto/pin/intel64/bin/pinbin

Program received signal SIGUSR1, User defined signal 1.
0x00007ffff7edba1b in OS_BARESYSCALL_DoCallAsmIntel64Linux () from /home/necto/pin/intel64/runtime/pincrt/libc-dynamic.so
(gdb) bt
#0  0x00007ffff7edba1b in OS_BARESYSCALL_DoCallAsmIntel64Linux () from /home/necto/pin/intel64/runtime/pincrt/libc-dynamic.so
#1  0x00007fffffffd3d0 in ?? ()
#2  0x00007ffff7edbb53 in OS_SyscallDo () from /home/necto/pin/intel64/runtime/pincrt/libc-dynamic.so
#3  0x00007ffff7eda4a3 in OS_SendSignalToThread () from /home/necto/pin/intel64/runtime/pincrt/libc-dynamic.so
#4  0x00007ffff7ed8f8a in OS_RaiseException () from /home/necto/pin/intel64/runtime/pincrt/libc-dynamic.so
#5  0x00007ffff7e87dad in raise () from /home/necto/pin/intel64/runtime/pincrt/libc-dynamic.so
#6  0x00005555558e747e in ?? ()
#7  0x00005555558e757e in LEVEL_INJECTOR::DoSystemChecks() ()
#8  0x00005555558db0ae in LEVEL_INJECTOR::UNIX_INJECTOR::Run() ()
#9  0x00005555558e0695 in LEVEL_INJECTOR::PIN_UNIX_ENVIRONMENT::LaunchPin() ()
#10 0x00005555558c8be5 in LEVEL_INJECTOR::PIN_ENVIRONMENT::Main() ()
#11 0x0000555555657cf9 in main ()
(gdb) 

回溯看起来并不熟悉。如何找出此段错误的原因？

编辑

根据@Employed Russian 的建议，我让gdb 将SIGUSR1 传递给pin，这有助于它前进，但还远远不够：

(gdb) handle SIGUSR1 nostop noprint pass
Signal        Stop      Print   Pass to program Description
SIGUSR1       No        No      Yes             User defined signal 1
(gdb) r
Starting program: /home/necto/pin/pin -appdebug -t /home/necto/pin-trace.so -- ./executable2 <args to the executable>
process 186041 is executing new program: /home/necto/pin/intel64/bin/pinbin
E: Attach to pid 186041 failed. 
E:   The Operating System configuration prevents Pin from using the default (parent) injection mode.
E:   To resolve this, either execute the following (as root):
E:   $ echo 0 > /proc/sys/kernel/yama/ptrace_scope
E:   Or use the "-injection child" option.
E:   For more information, regarding child injection, see Injection section in the Pin User Manual.
E: 

编辑2

问题出在我的 pin 工具上。我的 pin 工具 pin-trace.so 从用户代码（从应用程序）调用一个函数。此函数在 executable2 中的断言上失败，这成为 pin 中的异常并转换为 segfault，未被处理。

Answer 1

直接在 gdb 下运行时，它似乎失败了（在 SIGUSR1 上）

看起来pin 正在尝试在内部使用SGIUSR1。如果您要求 GDB 使用 handle SIGUSR1 nostop noprint pass 忽略此信号，您​​的 GDB 会话可能会继续进行，希望在 NULL 指针取消引用时崩溃。

如果有帮助，这个：

C: Tool (or Pin) caused signal 11 at PC 0x000000000

表示您的 pintool（或 pin 本身）调用了 NULL 函数指针。