Merge pull request #15431 from taosdata/fix/TS-1670

fix(query): fixed a free race condition

src/client/inc/tsclient.h

@@ -387,6 +387,7 @@ typedef struct SSqlObj {
   SSqlRes          res;
 
   SSubqueryState   subState;
+  pthread_mutex_t  mtxSubs;        // avoid double access pSubs after failure
   struct SSqlObj **pSubs;
   struct SSqlObj  *rootObj;
 

src/client/src/tscAsync.c

@@ -46,6 +46,8 @@ void doAsyncQuery(STscObj* pObj, SSqlObj* pSql, __async_cb_func_t fp, void* para
   pSql->fetchFp   = fp;
   pSql->rootObj   = pSql;
 
+  pthread_mutex_init(&pSql->mtxSubs, NULL);
+
   registerSqlObj(pSql);
 
   pSql->sqlstr = calloc(1, sqlLen + 1);

src/client/src/tscServer.c

@@ -3251,7 +3251,9 @@ int tscRenewTableMeta(SSqlObj *pSql) {
   pSql->rootObj->retryReason = pSql->retryReason;
 
   SSqlObj *rootSql = pSql->rootObj;
+  pthread_mutex_lock(&rootSql->mtxSubs);
   tscFreeSubobj(rootSql);
+  pthread_mutex_unlock(&rootSql->mtxSubs);
   tfree(rootSql->pSubs);
   tscResetSqlCmd(&rootSql->cmd, true, rootSql->self);
 

src/client/src/tscUtil.c

@@ -1760,6 +1760,10 @@ void tscFreeSqlObj(SSqlObj* pSql) {
 
   tscFreeSubobj(pSql);
 
+  if (pSql && (pSql == pSql->rootObj)) {
+    pthread_mutex_destroy(&pSql->mtxSubs);
+  }
+
   pSql->signature = NULL;
   pSql->fp = NULL;
   tfree(pSql->sqlstr);