Merge pull request #17032 from taosdata/fix/fixInvalidFree

fix(tsc): fix invalid free

include/common/tmsg.h

@@ -2337,6 +2337,7 @@ int32_t tSerializeSClientHbBatchReq(void* buf, int32_t bufLen, const SClientHbBa
 int32_t tDeserializeSClientHbBatchReq(void* buf, int32_t bufLen, SClientHbBatchReq* pReq);
 
 static FORCE_INLINE void tFreeClientHbBatchReq(void* pReq) {
+  if (pReq == NULL) return;
   SClientHbBatchReq* req = (SClientHbBatchReq*)pReq;
   taosArrayDestroyEx(req->reqs, tFreeClientHbReq);
   taosMemoryFree(pReq);

source/client/src/clientHb.c

@@ -606,28 +606,34 @@ SClientHbBatchReq *hbGatherAllInfo(SAppHbMgr *pAppHbMgr) {
   int32_t connKeyCnt = atomic_load_32(&pAppHbMgr->connKeyCnt);
   pBatchReq->reqs = taosArrayInit(connKeyCnt, sizeof(SClientHbReq));
 
+  int64_t rid = -1;
   int32_t code = 0;
-  void   *pIter = taosHashIterate(pAppHbMgr->activeInfo, NULL);
-  while (pIter != NULL) {
-    SClientHbReq *pOneReq = pIter;
 
-    pOneReq = taosArrayPush(pBatchReq->reqs, pOneReq);
+  void *pIter = taosHashIterate(pAppHbMgr->activeInfo, NULL);
 
+  SClientHbReq *pOneReq = pIter;
+  SClientHbKey *connKey = pOneReq ? &pOneReq->connKey : NULL;
+  if (connKey != NULL) rid = connKey->tscRid;
+
+  STscObj *pTscObj = (STscObj *)acquireTscObj(rid);
+  if (pTscObj == NULL) {
+    tFreeClientHbBatchReq(pBatchReq);
+    return NULL;
+  }
+
+  while (pIter != NULL) {
+    pOneReq = taosArrayPush(pBatchReq->reqs, pOneReq);
     code = (*clientHbMgr.reqHandle[pOneReq->connKey.connType])(&pOneReq->connKey, &pOneReq->clusterId, pOneReq);
     if (code) {
       pIter = taosHashIterate(pAppHbMgr->activeInfo, pIter);
+      pOneReq = pIter;
       continue;
     }
 
-    // hbClearClientHbReq(pOneReq);
-
     pIter = taosHashIterate(pAppHbMgr->activeInfo, pIter);
+    pOneReq = pIter;
   }
-
-  //  if (code) {
-  //    taosArrayDestroyEx(pBatchReq->reqs, hbFreeReq);
-  //    taosMemoryFreeClear(pBatchReq);
-  //  }
+  releaseTscObj(rid);
 
   return pBatchReq;
 }

source/libs/transport/src/thttp.c

@@ -146,7 +146,7 @@ static FORCE_INLINE void clientRecvCb(uv_stream_t* handle, ssize_t nread, const
   if (nread < 0) {
     uError("http-report recv error:%s", uv_err_name(nread));
   } else {
-    uTrace("http-report succ to recv %d bytes, just ignore it", nread);
+    uTrace("http-report succ to recv %d bytes", nread);
   }
   uv_close((uv_handle_t*)&cli->tcp, clientCloseCb);
 }
@@ -160,7 +160,16 @@ static void clientSentCb(uv_write_t* req, int32_t status) {
   } else {
     uTrace("http-report succ to send data");
   }
-  uv_read_start((uv_stream_t*)&cli->tcp, clientAllocBuffCb, clientRecvCb);
+  status = uv_read_start((uv_stream_t*)&cli->tcp, clientAllocBuffCb, clientRecvCb);
+  if (status != 0) {
+    terrno = TAOS_SYSTEM_ERROR(status);
+    uError("http-report failed to recv data,reason:%s, dst:%s:%d", uv_strerror(status), cli->addr, cli->port);
+    if (!uv_is_closing((uv_handle_t*)&cli->tcp)) {
+      uv_close((uv_handle_t*)&cli->tcp, clientCloseCb);
+    } else {
+      destroyHttpClient(cli);
+    }
+  }
 }
 static void clientConnCb(uv_connect_t* req, int32_t status) {
   SHttpClient* cli = req->data;
@@ -170,7 +179,16 @@ static void clientConnCb(uv_connect_t* req, int32_t status) {
     uv_close((uv_handle_t*)&cli->tcp, clientCloseCb);
     return;
   }
-  uv_write(&cli->req, (uv_stream_t*)&cli->tcp, cli->wbuf, 2, clientSentCb);
+  status = uv_write(&cli->req, (uv_stream_t*)&cli->tcp, cli->wbuf, 2, clientSentCb);
+  if (0 != status) {
+    terrno = TAOS_SYSTEM_ERROR(status);
+    uError("http-report failed to send data,reason:%s, dst:%s:%d", uv_strerror(status), cli->addr, cli->port);
+    if (!uv_is_closing((uv_handle_t*)&cli->tcp)) {
+      uv_close((uv_handle_t*)&cli->tcp, clientCloseCb);
+    } else {
+      destroyHttpClient(cli);
+    }
+  }
 }
 
 static FORCE_INLINE int32_t taosBuildDstAddr(const char* server, uint16_t port, struct sockaddr_in* dest) {
@@ -220,13 +238,22 @@ int32_t taosSendHttpReport(const char* server, uint16_t port, char* pCont, int32
   uv_tcp_init(loop, &cli->tcp);
   // set up timeout to avoid stuck;
   int32_t fd = taosCreateSocketWithTimeout(5);
-  uv_tcp_open((uv_tcp_t*)&cli->tcp, fd);
 
-  int32_t ret = uv_tcp_connect(&cli->conn, &cli->tcp, (const struct sockaddr*)&dest, clientConnCb);
+  int ret = uv_tcp_open((uv_tcp_t*)&cli->tcp, fd);
   if (ret != 0) {
-    uError("http-report failed to connect to server, reason:%s, dst:%s:%d", uv_strerror(ret), cli->addr, cli->port);
+    uError("http-report failed to open socket, reason:%s, dst:%s:%d", uv_strerror(ret), cli->addr, cli->port);
     destroyHttpClient(cli);
     uv_stop(loop);
+    terrno = TAOS_SYSTEM_ERROR(ret);
+  } else {
+    ret = uv_tcp_connect(&cli->conn, &cli->tcp, (const struct sockaddr*)&dest, clientConnCb);
+    if (ret != 0) {
+      uError("http-report failed to connect to http-server, reason:%s, dst:%s:%d", uv_strerror(ret), cli->addr,
+             cli->port);
+      destroyHttpClient(cli);
+      uv_stop(loop);
+      terrno = TAOS_SYSTEM_ERROR(ret);
+    }
   }
 
   uv_run(loop, UV_RUN_DEFAULT);