未验证 提交 d6e878ff 编写于 作者: M Minglei Jin 提交者: GitHub

Merge pull request #15431 from taosdata/fix/TS-1670

fix(query): fixed a free race condition
...@@ -387,6 +387,7 @@ typedef struct SSqlObj { ...@@ -387,6 +387,7 @@ typedef struct SSqlObj {
SSqlRes res; SSqlRes res;
SSubqueryState subState; SSubqueryState subState;
pthread_mutex_t mtxSubs; // avoid double access pSubs after failure
struct SSqlObj **pSubs; struct SSqlObj **pSubs;
struct SSqlObj *rootObj; struct SSqlObj *rootObj;
......
...@@ -46,6 +46,8 @@ void doAsyncQuery(STscObj* pObj, SSqlObj* pSql, __async_cb_func_t fp, void* para ...@@ -46,6 +46,8 @@ void doAsyncQuery(STscObj* pObj, SSqlObj* pSql, __async_cb_func_t fp, void* para
pSql->fetchFp = fp; pSql->fetchFp = fp;
pSql->rootObj = pSql; pSql->rootObj = pSql;
pthread_mutex_init(&pSql->mtxSubs, NULL);
registerSqlObj(pSql); registerSqlObj(pSql);
pSql->sqlstr = calloc(1, sqlLen + 1); pSql->sqlstr = calloc(1, sqlLen + 1);
......
...@@ -3251,7 +3251,9 @@ int tscRenewTableMeta(SSqlObj *pSql) { ...@@ -3251,7 +3251,9 @@ int tscRenewTableMeta(SSqlObj *pSql) {
pSql->rootObj->retryReason = pSql->retryReason; pSql->rootObj->retryReason = pSql->retryReason;
SSqlObj *rootSql = pSql->rootObj; SSqlObj *rootSql = pSql->rootObj;
pthread_mutex_lock(&rootSql->mtxSubs);
tscFreeSubobj(rootSql); tscFreeSubobj(rootSql);
pthread_mutex_unlock(&rootSql->mtxSubs);
tfree(rootSql->pSubs); tfree(rootSql->pSubs);
tscResetSqlCmd(&rootSql->cmd, true, rootSql->self); tscResetSqlCmd(&rootSql->cmd, true, rootSql->self);
......
...@@ -1760,6 +1760,10 @@ void tscFreeSqlObj(SSqlObj* pSql) { ...@@ -1760,6 +1760,10 @@ void tscFreeSqlObj(SSqlObj* pSql) {
tscFreeSubobj(pSql); tscFreeSubobj(pSql);
if (pSql && (pSql == pSql->rootObj)) {
pthread_mutex_destroy(&pSql->mtxSubs);
}
pSql->signature = NULL; pSql->signature = NULL;
pSql->fp = NULL; pSql->fp = NULL;
tfree(pSql->sqlstr); tfree(pSql->sqlstr);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册