diff --git a/src/client/src/tscSubquery.c b/src/client/src/tscSubquery.c
index 4576af6e81bd712ab25d40eacc880bc058df6c83..a27a8a41a1d5c7e2f6e8f1b81063cde24de2beb9 100644
--- a/src/client/src/tscSubquery.c
+++ b/src/client/src/tscSubquery.c
@@ -2732,7 +2732,7 @@ void tscHandleSubqueryError(SRetrieveSupport *trsupport, SSqlObj *pSql, int numO
       SSqlObj *userSql = ((SRetrieveSupport*)pParentSql->param)->pParentSql;
 
       tscFreeSubobj(userSql);      
-      tfree(pSql->pSubs);
+      tfree(userSql->pSubs);
 
       pParentSql->res.code = TSDB_CODE_SUCCESS;
       pParentSql->retry++;
diff --git a/src/client/src/tscUtil.c b/src/client/src/tscUtil.c
index cb797b5ceb2cbca0edc9e5e9e03d4b6b4c33a14f..ba533bb03baea5cb444e7b99504cf7ea25747f90 100644
--- a/src/client/src/tscUtil.c
+++ b/src/client/src/tscUtil.c
@@ -3768,7 +3768,7 @@ static void tscSubqueryCompleteCallback(void* param, TAOS_RES* tres, int code) {
     SSqlObj *userSql = ((SRetrieveSupport*)pParentSql->param)->pParentSql;
 
     tscFreeSubobj(userSql);    
-    tfree(pSql->pSubs);
+    tfree(userSql->pSubs);
 
     pParentSql->res.code = TSDB_CODE_SUCCESS;
     pParentSql->retry++;