[PATCH 01/23] perf/x86/intel: Guard counter masks against zero counters

From: Zide Chen

Date: Fri Aug 21 2026 - 18:31:27 EST


When running as a guest with a vPMU exposed, the host may expose zero
general-purpose counters or zero fixed counters. In that case,
GENMASK_ULL() is called with a negative high-bit argument, resulting
in an out-of-range shift and undefined behavior.

On systems with PMU partitioning enabled, this configuration is more
likely. Change GENMASK_ULL() to BIT_ULL() to guard mask generation
against zero counters.

Fixes: 722e42e45c2f ("perf/x86: Support counter mask")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Zide Chen <zide.chen@xxxxxxxxx>
---
arch/x86/events/intel/core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 2b35483e2b70..8b13bcc5259c 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -7905,7 +7905,7 @@ __init int intel_pmu_init(void)
x86_pmu = intel_pmu;

x86_pmu.version = version;
- x86_pmu.cntr_mask64 = GENMASK_ULL(eax.split.num_counters - 1, 0);
+ x86_pmu.cntr_mask64 = BIT_ULL(eax.split.num_counters) - 1;
x86_pmu.cntval_bits = eax.split.bit_width;
x86_pmu.cntval_mask = (1ULL << eax.split.bit_width) - 1;

@@ -7924,7 +7924,7 @@ __init int intel_pmu_init(void)
int assume = 3 * !boot_cpu_has(X86_FEATURE_HYPERVISOR);

x86_pmu.fixed_cntr_mask64 =
- GENMASK_ULL(max((int)edx.split.num_counters_fixed, assume) - 1, 0);
+ BIT_ULL(max((int)edx.split.num_counters_fixed, assume)) - 1;
} else if (version >= 5)
x86_pmu.fixed_cntr_mask64 = fixed_mask;

--
2.55.0