From ba7acaa5bcde42a098441a586c0a392ae431bf2c Mon Sep 17 00:00:00 2001
From: yifan hao <hyifan@vmware.com>
Date: Fri, 8 May 2020 18:52:17 -0600
Subject: [PATCH] [Timer] Initialize the last tmrCtrls.

While initialize timer module, tmrCtrls is constructed to be a free
list. However, the last tmrCtrls is never initialized, which is
allocated from malloc(). Since the code relies on tmrCtrls->next
to tell if there's any free tmrCtrls left, the last tmrCtrls should
be properly linked to NULL.
---
 src/util/src/ttimer.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/src/util/src/ttimer.c b/src/util/src/ttimer.c
index 42fd13b2cd..e6ef73ef57 100644
--- a/src/util/src/ttimer.c
+++ b/src/util/src/ttimer.c
@@ -405,19 +405,19 @@ static bool doStopTimer(tmr_obj_t* timer, uint8_t state) {
     tmrTrace(fmt, timer->ctrl->label, timer->id, timer->fp, timer->param);
     return reusable;
   }
-  
+
   if (state != TIMER_STATE_EXPIRED) {
     // timer already stopped or cancelled, has nothing to do in this case
     return false;
   }
-  
+
   if (timer->executedBy == taosGetPthreadId()) {
     // taosTmrReset is called in the timer callback, should do nothing in this
     // case to avoid dead lock. note taosTmrReset must be the last statement
     // of the callback funtion, will be a bug otherwise.
     return false;
   }
-  
+
   // timer callback is executing in another thread, we SHOULD wait it to stop,
   // BUT this may result in dead lock if current thread are holding a lock which
   // the timer callback need to acquire. so, we HAVE TO return directly.
@@ -501,6 +501,7 @@ static void taosTmrModuleInit(void) {
     tmr_ctrl_t* ctrl = tmrCtrls + i;
     ctrl->next = ctrl + 1;
   }
+  (tmrCtrls + taosMaxTmrCtrl - 1)->next = NULL;
   unusedTmrCtrl = tmrCtrls;
 
   pthread_mutex_init(&tmrCtrlMutex, NULL);
@@ -574,12 +575,12 @@ void taosTmrCleanUp(void* handle) {
 
   if (numOfTmrCtrl <=0) {
     taosUninitTimer();
-    
+
     taosCleanUpScheduler(tmrQhandle);
 
     for (int i = 0; i < tListLen(wheels); i++) {
       time_wheel_t* wheel = wheels + i;
-      pthread_mutex_destroy(&wheel->mutex); 
+      pthread_mutex_destroy(&wheel->mutex);
       free(wheel->slots);
     }