[PATCH 01/23] perf/x86/intel: Guard counter masks against zero counters
From: Zide Chen
Date: Fri Aug 21 2026 - 18:31:27 EST
When running as a guest with a vPMU exposed, the host may expose zero
general-purpose counters or zero fixed counters. In that case,
GENMASK_ULL() is called with a negative high-bit argument, resulting
in an out-of-range shift and undefined behavior.
On systems with PMU partitioning enabled, this configuration is more
likely. Change GENMASK_ULL() to BIT_ULL() to guard mask generation
against zero counters.
Fixes: 722e42e45c2f ("perf/x86: Support counter mask")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Zide Chen <zide.chen@xxxxxxxxx>
---
arch/x86/events/intel/core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 2b35483e2b70..8b13bcc5259c 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -7905,7 +7905,7 @@ __init int intel_pmu_init(void)
x86_pmu = intel_pmu;
x86_pmu.version = version;
- x86_pmu.cntr_mask64 = GENMASK_ULL(eax.split.num_counters - 1, 0);
+ x86_pmu.cntr_mask64 = BIT_ULL(eax.split.num_counters) - 1;
x86_pmu.cntval_bits = eax.split.bit_width;
x86_pmu.cntval_mask = (1ULL << eax.split.bit_width) - 1;
@@ -7924,7 +7924,7 @@ __init int intel_pmu_init(void)
int assume = 3 * !boot_cpu_has(X86_FEATURE_HYPERVISOR);
x86_pmu.fixed_cntr_mask64 =
- GENMASK_ULL(max((int)edx.split.num_counters_fixed, assume) - 1, 0);
+ BIT_ULL(max((int)edx.split.num_counters_fixed, assume)) - 1;
} else if (version >= 5)
x86_pmu.fixed_cntr_mask64 = fixed_mask;
--
2.55.0