[PATCH v2] futex: Use a keyed hash for global futex buckets

[Kyle Zeng <kylebot@openai.com>]

The global futex hash is a public jhash2 of the key, which for private
and shared-anonymous futexes includes an mm_struct pointer. A task can
populate a bucket with futex_waitv() and time nonmatching wakes to learn
which chosen user addresses collide. Shared-file keys have predictable
inode sequence numbers, so the task can also identify the bucket and
turn those timings into constraints on current->mm.

Lukas Maar, Jonas Juffinger, Thomas Steinbauer, Daniel Gruss, and Stefan
Mangard described this futex mm_struct disclosure in KernelSnitch at
NDSS 2025. Section VI-B recovers the pointer by observing futex hash
collisions and evaluating jhash2 offline.

The per-mm private hash does not prevent this: a task can disable it
through PR_FUTEX_HASH. NUMA-routed private futexes and shared-anonymous
keys also use the global hash.

Use SipHash-2-4 with a boot-time random key for global bucket selection.
Hash the three identity fields individually, without padding or the
separately handled NUMA node. Keep the original futex keys and equality
checks, and leave the per-mm hash, which only hashes userspace addresses
and offsets, unchanged. Initialize the secret before the global tables
are made available and keep it fixed for their lifetime.

Reported-by: Lukas Maar <lukas.maar@tugraz.at>
Link: https://www.ndss-symposium.org/ndss-paper/kernelsnitch-side-channel-attacks-on-kernel-data-structures/
Assisted-by: LLM
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
Changes in v2:
- Credit the KernelSnitch authors and link their prior publication.
- Add the original researcher's Reported-by trailer.
- No source changes.

 kernel/futex/core.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/kernel/futex/core.c b/kernel/futex/core.c
index 095f9fe440e3..c07570ce8b55 100644
--- a/kernel/futex/core.c
+++ b/kernel/futex/core.c
@@ -42,7 +42,9 @@
 #include <linux/pagemap.h>
 #include <linux/plist.h>
 #include <linux/prctl.h>
+#include <linux/random.h>
 #include <linux/rseq.h>
+#include <linux/siphash.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/kmemleak.h>
@@ -58,6 +60,7 @@
 static u32 __futex_mask __ro_after_init;
 static u32 __futex_shift __ro_after_init;
 static struct futex_hash_bucket **__futex_queues __ro_after_init;
+static siphash_key_t futex_hash_key __ro_after_init;
 
 static __always_inline struct futex_hash_bucket **futex_queues(void)
 {
@@ -388,8 +391,12 @@ __futex_hash(union futex_key *key, struct futex_private_hash *fph, struct futex_
 	}
 #endif
 
-	hash = jhash2((u32 *)key, offsetof(typeof(*key), both.offset) / sizeof(u32),
-		      key->both.offset);
+	/*
+	 * Global bucket collisions are observable through futex operations.
+	 * Use a keyed hash so they do not disclose the mm pointer in the key.
+	 */
+	hash = siphash_3u64(key->both.ptr, key->both.word, key->both.offset,
+			    &futex_hash_key);
 
 	if (node == FUTEX_NO_NODE) {
 		/*
@@ -2092,6 +2099,8 @@ static int __init futex_init(void)
 	unsigned int order, n;
 	unsigned long size;
 
+	get_random_bytes(&futex_hash_key, sizeof(futex_hash_key));
+
 #ifdef CONFIG_BASE_SMALL
 	hashsize = 16;
 #else

base-commit: 0fcb05b72344f40806cbe810de8872f1698bf053