PTRACE_EVENT_VFORK_DONE should not be reported if the tracer cleared PTRACE_O_TRACEVFORKDONE after the tracee stopped in PTRACE_EVENT_VFORK report. Now that we have ptrace_event->ev_options this is trivial.
ptrace_report_clone() still needs more changes. I think it is simple to fix it now, but can't we simplify the utrace's behaviour first? utrace_report_clone() does not set utrace->vfork_stop without CLONE_VFORK, this adds some complications. Perhaps we can kill CLONE_VFORK check? --- kernel/ptrace.c | 1 + 1 file changed, 1 insertion(+) --- PU/kernel/ptrace.c~40_EV_O_TRACEVFORKDONE 2009-09-15 19:47:50.000000000 +0200 +++ PU/kernel/ptrace.c 2009-09-15 20:40:35.000000000 +0200 @@ -283,6 +283,7 @@ static u32 ptrace_report_clone(enum utra struct ptrace_event *ev = ev_push(context); ev->ev_message = child->pid; + ev->ev_options = PTRACE_O_TRACEVFORKDONE; ev->ev_code = (PTRACE_EVENT_VFORK_DONE << 8) | SIGTRAP; ret = UTRACE_STOP;