diff --git a/src/client/src/tscProfile.c b/src/client/src/tscProfile.c
index ea2a3d82288318c79fd38f2c3019a70438589ef9..7870ca797686e37fbcc13374ba8c9bc52dc61a39 100644
--- a/src/client/src/tscProfile.c
+++ b/src/client/src/tscProfile.c
@@ -295,23 +295,18 @@ int tscBuildQueryStreamDesc(void *pMsg, STscObj *pObj) {
 }
 
 void tscKillConnection(STscObj *pObj) {
+  // get stream header by locked
   pthread_mutex_lock(&pObj->mutex);
-
-  SSqlObj *pSql = pObj->sqlList;
-  while (pSql) {
-    pSql = pSql->next;
-  }
-  
-
   SSqlStream *pStream = pObj->streamList;
+  pthread_mutex_unlock(&pObj->mutex);
+
   while (pStream) {
     SSqlStream *tmp = pStream->next;
+    // taos_close_stream function call pObj->mutet lock , careful death-lock
     taos_close_stream(pStream);
     pStream = tmp;
   }
 
-  pthread_mutex_unlock(&pObj->mutex);
-
   tscDebug("connection:%p is killed", pObj);
   taos_close(pObj);
 }
diff --git a/src/client/src/tscStream.c b/src/client/src/tscStream.c
index b60824b2fa1e0d03d5a80e2e7677967e4c7ba031..3fd727a745181488e5f1b6994263c0b6110eebea 100644
--- a/src/client/src/tscStream.c
+++ b/src/client/src/tscStream.c
@@ -141,6 +141,10 @@ static void tscProcessStreamTimer(void *handle, void *tmrId) {
 
   pStream->numOfRes = 0;  // reset the numOfRes.
   SSqlObj *pSql = pStream->pSql;
+  // pSql ==  NULL  maybe killStream already called
+  if(pSql == NULL) {
+    return ;
+  }
   SQueryInfo* pQueryInfo = tscGetQueryInfoDetail(&pSql->cmd, 0);
   tscDebug("0x%"PRIx64" add into timer", pSql->self);