[PATCH] crypto/openssl: fix SM2 encryption output length

[Ji, Kai]

Acked-by: Kai Ji <kai.ji at intel.com>


________________________________
From: Sun Yuechi <sunyuechi at iscas.ac.cn>
Sent: Monday, October 26, 2026 14:16
To: Ji, Kai <kai.ji at intel.com>; Akhil Goyal <gakhil at marvell.com>; Gowrishankar Muthukrishnan <gmuthukrishn at marvell.com>
Cc: dev at dpdk.org <dev at dpdk.org>; Sun Yuechi <sunyuechi at iscas.ac.cn>; stable at dpdk.org <stable at dpdk.org>
Subject: [PATCH] crypto/openssl: fix SM2 encryption output length

SM2 encryption passed a zero output length to EVP_PKEY_encrypt(),
which OpenSSL 3.6.3 and later reject as "buffer too small".
Query the required length first, as the RSA path does.

Fixes: 3b7d638fb11f ("crypto/openssl: support asymmetric SM2")
Cc: stable at dpdk.org
Signed-off-by: Sun Yuechi <sunyuechi at iscas.ac.cn>
---
 drivers/crypto/openssl/rte_openssl_pmd.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/crypto/openssl/rte_openssl_pmd.c b/drivers/crypto/openssl/rte_openssl_pmd.c
index 1b33470c8f..8791186fec 100644
--- a/drivers/crypto/openssl/rte_openssl_pmd.c
+++ b/drivers/crypto/openssl/rte_openssl_pmd.c
@@ -2791,6 +2791,10 @@ process_openssl_sm2_op_evp(struct rte_crypto_op *cop,
                         if (!EVP_PKEY_CTX_set_params(cctx, eparams))
                                 goto err_sm2;

+                       if (!EVP_PKEY_encrypt(cctx, NULL, &output_len,
+                                       op->sm2.message.data, op->sm2.message.length))
+                               goto err_sm2;
+
                         if (!EVP_PKEY_encrypt(cctx, op->sm2.cipher.data, &output_len,
                                                                  op->sm2.message.data,
                                                                  op->sm2.message.length))
--
2.56.0

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mails.dpdk.org/archives/stable/attachments/20261103/d34143c2/attachment.htm>