|SUCCESS| crypto/openssl: fix SM2 encryption output length

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: SUCCESS
https://dpdk.org/patch/172085

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-10-26

# DPDK Patch Review

## ERRORS

None identified.

## WARNINGS

None identified.

## INFO

**Pre-existing: Missing error path cleanup** (line not in patch)

The `process_openssl_sm2_op_evp()` function contains error paths that jump to `err_sm2:` after allocating `cctx` via `EVP_PKEY_CTX_new_from_pkey()`. The patch adds two new calls to `EVP_PKEY_encrypt()` that can fail and jump to `err_sm2:` without first checking that `cctx` is non-NULL or ensuring it gets freed. This is a pre-existing pattern in the function (visible in surrounding context where similar checks exist), but the new code follows the existing style. No issue introduced by this patch.

**Correctness of the fix:**

The patch correctly addresses the SM2 encryption output length issue. The added code follows the same two-step pattern used for RSA encryption elsewhere in DPDK OpenSSL PMD:

1. First call to `EVP_PKEY_encrypt()` with `NULL` output buffer queries the required length
2. Second call with the actual buffer performs the encryption

This matches OpenSSL's documented API usage and the existing RSA implementation in the same driver.

The patch is a minimal, correct fix for the stated issue (OpenSSL 3.6.3+ rejecting zero-length output buffers).

---

Review-Result: CLEAN