This is simple. Now that we report PTRACE_EVENT_VFORK_DONE we should check it to handle PTRACE_SYSCALL/SINGLESTEP before return to user-mode.
--- kernel/ptrace.c | 2 ++ 1 file changed, 2 insertions(+) --- PU/kernel/ptrace.c~98_VFORKDONE_THEN_SYSCALL 2009-10-17 19:37:45.000000000 +0200 +++ PU/kernel/ptrace.c 2009-10-17 19:46:42.000000000 +0200 @@ -990,6 +990,7 @@ static void do_ptrace_resume(struct utra case PTRACE_EVENT_EXEC: case PTRACE_EVENT_FORK: case PTRACE_EVENT_CLONE: + case PTRACE_EVENT_VFORK_DONE: set_syscall_code(context, PTRACE_EVENT_SYSCALL_EXIT); do_ptrace_notify_stop(context, tracee); return; @@ -1001,6 +1002,7 @@ static void do_ptrace_resume(struct utra case PTRACE_EVENT_EXEC: case PTRACE_EVENT_FORK: case PTRACE_EVENT_CLONE: + case PTRACE_EVENT_VFORK_DONE: case PTRACE_EVENT_SYSCALL_EXIT: read_lock(&tasklist_lock); if (tracee->sighand)