ntdll: Map executable PE sections anonymously when W^X denies RX on Android

[utkarshdalal]

What

On Android, executable PE sections (.text) can end up non-executable to the CPU even though Wine believes it set them RX. The first instruction fetch into such a section — observed on arm64ec for ntdll/kernelbase/kernel32 — faults with SIGSEGV / SEGV_ACCERR.

This adds remap_exec_anon() and wires it into map_image_into_view, so that when the RX mprotect is denied we privatize the section into anonymous memory and set it executable at load time.

Why

Wine maps PE sections MAP_PRIVATE file-backed (VPROT_WRITECOPY) and then relocates them, which dirties the COW pages. Android's SELinux W^X enforcement — specifically the execmod permission ("make executable a modified private file mapping") — denies the subsequent mprotect(..., PROT_EXEC) with EACCES. The section is then left readable/writable but not executable.

Anonymous memory is not subject to execmod (it only needs execmem, which is granted in this environment), so copying the already-relocated bytes into an anonymous mapping and setting RX there succeeds.

How

• remap_exec_anon() (new, __ANDROID__-only): set the range readable, stage its contents into a temporary anonymous mapping, MAP_FIXED-replace the range with anonymous private memory, copy the contents back, apply the requested protection, and __builtin___clear_cache() if executable.
• Per-section protection path: when set_vprot fails to set RX on an executable section, call remap_exec_anon and, on success, update the per-page vprot bookkeeping via set_page_vprot so Wine's recorded protection matches reality. Only ERRs if the rebake itself fails.
• ImageMappedFlat branch: same treatment for flat/native-subsystem images where the whole image is set RX in one call.

Notes for reviewers

• All changes are gated on __ANDROID__; non-Android builds are unchanged.
• Runs proactively at load under virtual_mutex, replacing the need for an external reactive SIGSEGV-driven rebake (LD_PRELOAD shim).
• Tradeoff: privatized sections lose file-backed cross-process page sharing. This is unavoidable under execmod and matches what the previous shim-based workaround already did.
• Not yet covered: the shared_fd shared-writable-exec section path; .text does not normally take it, but it could get the same helper if needed.

🤖 Generated with Claude Code