<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: "IntelOne Text"; font-size: 10pt; color: rgb(0, 0, 0);">
<span style="color: rgb(0, 0, 0);"></span>Acked-by: Kai Ji <kai.ji@intel.com></div>
<div><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<hr style="display: inline-block; width: 98%;">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<b>From:</b> Sun Yuechi <sunyuechi@iscas.ac.cn><br>
<b>Sent:</b> Monday, October 26, 2026 14:16<br>
<b>To:</b> Ji, Kai <kai.ji@intel.com>; Akhil Goyal <gakhil@marvell.com>; Gowrishankar Muthukrishnan <gmuthukrishn@marvell.com><br>
<b>Cc:</b> dev@dpdk.org <dev@dpdk.org>; Sun Yuechi <sunyuechi@iscas.ac.cn>; stable@dpdk.org <stable@dpdk.org><br>
<b>Subject:</b> [PATCH] crypto/openssl: fix SM2 encryption output length </div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-size: 11pt;">SM2 encryption passed a zero output length to EVP_PKEY_encrypt(),<br>
which OpenSSL 3.6.3 and later reject as "buffer too small".<br>
Query the required length first, as the RSA path does.<br>
<br>
Fixes: 3b7d638fb11f ("crypto/openssl: support asymmetric SM2")<br>
Cc: stable@dpdk.org<br>
Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn><br>
---<br>
 drivers/crypto/openssl/rte_openssl_pmd.c | 4 ++++<br>
 1 file changed, 4 insertions(+)<br>
<br>
diff --git a/drivers/crypto/openssl/rte_openssl_pmd.c b/drivers/crypto/openssl/rte_openssl_pmd.c<br>
index 1b33470c8f..8791186fec 100644<br>
--- a/drivers/crypto/openssl/rte_openssl_pmd.c<br>
+++ b/drivers/crypto/openssl/rte_openssl_pmd.c<br>
@@ -2791,6 +2791,10 @@ process_openssl_sm2_op_evp(struct rte_crypto_op *cop,<br>
                         if (!EVP_PKEY_CTX_set_params(cctx, eparams))<br>
                                 goto err_sm2;<br>
 <br>
+                       if (!EVP_PKEY_encrypt(cctx, NULL, &output_len,<br>
+                                       op->sm2.message.data, op->sm2.message.length))<br>
+                               goto err_sm2;<br>
+<br>
                         if (!EVP_PKEY_encrypt(cctx, op->sm2.cipher.data, &output_len,<br>
                                                                  op->sm2.message.data,<br>
                                                                  op->sm2.message.length))<br>
--<br>
2.56.0<br>
<br>
</div>
</body>
</html>