diff --git a/src/client/src/tscSubquery.c b/src/client/src/tscSubquery.c
index 4576af6e81..a27a8a41a1 100644
--- a/src/client/src/tscSubquery.c
+++ b/src/client/src/tscSubquery.c
@@ -2732,7 +2732,7 @@ void tscHandleSubqueryError(SRetrieveSupport *trsupport, SSqlObj *pSql, int numO
       SSqlObj *userSql = ((SRetrieveSupport*)pParentSql->param)->pParentSql;
 
       tscFreeSubobj(userSql);      
-      tfree(pSql->pSubs);
+      tfree(userSql->pSubs);
 
       pParentSql->res.code = TSDB_CODE_SUCCESS;
       pParentSql->retry++;
diff --git a/src/client/src/tscUtil.c b/src/client/src/tscUtil.c
index cb797b5ceb..ba533bb03b 100644
--- a/src/client/src/tscUtil.c
+++ b/src/client/src/tscUtil.c
@@ -3768,7 +3768,7 @@ static void tscSubqueryCompleteCallback(void* param, TAOS_RES* tres, int code) {
     SSqlObj *userSql = ((SRetrieveSupport*)pParentSql->param)->pParentSql;
 
     tscFreeSubobj(userSql);    
-    tfree(pSql->pSubs);
+    tfree(userSql->pSubs);
 
     pParentSql->res.code = TSDB_CODE_SUCCESS;
     pParentSql->retry++;