All known memory problem is solved.

src/amf/context.c

@@ -1488,6 +1488,9 @@ void amf_sess_remove(amf_sess_t *sess)
     if (sess->dnn)
         ogs_free(sess->dnn);
 
+    if (sess->n2smbuf)
+        ogs_pkbuf_free(sess->n2smbuf);
+
     OGS_NAS_CLEAR_DATA(&sess->ue_pco);
     OGS_TLV_CLEAR_DATA(&sess->pgw_pco);
 

src/amf/namf-handler.c

@@ -120,6 +120,10 @@ int amf_namf_comm_handle_n1_n2_message_transfer(
         ogs_error("[%s] No N1 SM Content", amf_ue->supi);
         return OGS_ERROR;
     }
+    /*
+     * NOTE : The pkbuf created in the SBI message will be removed
+     *        from ogs_sbi_message_free(), so it must be copied.
+     */
     n1smbuf = ogs_pkbuf_copy(n1smbuf);
     ogs_assert(n1smbuf);
 
@@ -128,6 +132,10 @@ int amf_namf_comm_handle_n1_n2_message_transfer(
         ogs_error("[%s] No N2 SM Content", amf_ue->supi);
         return OGS_ERROR;
     }
+    /*
+     * NOTE : The pkbuf created in the SBI message will be removed
+     *        from ogs_sbi_message_free(), so it must be copied.
+     */
     n2smbuf = ogs_pkbuf_copy(n2smbuf);
     ogs_assert(n2smbuf);
 

src/amf/ngap-build.c

@@ -421,8 +421,6 @@ ogs_pkbuf_t *ngap_build_initial_context_setup_request(
         transfer->size = sess->n2smbuf->len;
         transfer->buf = CALLOC(transfer->size, sizeof(uint8_t));
         memcpy(transfer->buf, sess->n2smbuf->data, transfer->size);
-        ogs_pkbuf_free(sess->n2smbuf);
-        sess->n2smbuf = NULL;
     }
 
     ie = CALLOC(1, sizeof(NGAP_InitialContextSetupRequestIEs_t));

src/amf/nsmf-handler.c

@@ -105,6 +105,10 @@ int amf_nsmf_pdu_session_handle_create_sm_context(
             return OGS_ERROR;
         }
 
+        /*
+         * NOTE : The pkbuf created in the SBI message will be removed
+         *        from ogs_sbi_message_free(), so it must be copied.
+         */
         n1smbuf = ogs_pkbuf_copy(n1smbuf);
         ogs_assert(n1smbuf);
         nas_5gs_send_gsm_reject_from_sbi(sess,
@@ -210,18 +214,29 @@ int amf_nsmf_pdu_session_handle_update_sm_context(
                 return OGS_ERROR;
             }
 
+            if (sess->n2smbuf) {
+                /* Free the old n2smbuf */
+                ogs_pkbuf_free(sess->n2smbuf);
+            }
+            /*
+             * NOTE : The pkbuf created in the SBI message will be removed
+             *        from ogs_sbi_message_free().
+             *        So it must be copied and push a event queue.
+             */
             sess->n2smbuf = ogs_pkbuf_copy(n2smbuf);
             ogs_assert(sess->n2smbuf);
 
             if (SESSION_SYNC_DONE(amf_ue)) {
                 nas_5gs_send_accept(amf_ue);
 
+#if 0 /* Move the context free to amf_sess_remove() */
                 ogs_list_for_each(&amf_ue->sess_list, sess) {
                     if (sess->n2smbuf) {
                         ogs_pkbuf_free(sess->n2smbuf);
                         sess->n2smbuf = NULL;
                     }
                 }
+#endif
             }
 
         } else {

src/smf/nas-path.c

@@ -17,11 +17,6 @@
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 
-#if 0
-#include "ngap-path.h"
-#include "ngap-build.h"
-#include "gsm-build.h"
-#endif
 #include "nas-path.h"
 
 void nas_5gs_send_to_gsm(smf_sess_t *sess, ogs_pkbuf_t *pkbuf)

src/smf/nsmf-handler.c

@@ -115,6 +115,13 @@ bool smf_nsmf_handle_create_sm_context(
         sess->dnn = ogs_strdup(SmContextCreateData->dnn);
     }
 
+    /*
+     * NOTE : The pkbuf created in the SBI message will be removed
+     *        from ogs_sbi_message_free().
+     *        So it must be copied and push a event queue.
+     */
+    n1smbuf = ogs_pkbuf_copy(n1smbuf);
+    ogs_assert(n1smbuf);
     nas_5gs_send_to_gsm(sess, n1smbuf);
 
     return true;
@@ -191,6 +198,13 @@ bool smf_nsmf_handle_update_sm_context(
         /* UPDATE_UpCnxState - ACTIVATED */
         sess->ueUpCnxState = OpenAPI_up_cnx_state_ACTIVATED;
 
+        /*
+         * NOTE : The pkbuf created in the SBI message will be removed
+         *        from ogs_sbi_message_free().
+         *        So it must be copied and push a event queue.
+         */
+        n2smbuf = ogs_pkbuf_copy(n2smbuf);
+        ogs_assert(n2smbuf);
         ngap_send_to_n2sm(sess, SmContextUpdateData->n2_sm_info_type, n2smbuf);
 
     } else {

tests/registration/idle-test.c

@@ -1663,7 +1663,7 @@ static void test4_func(abts_case *tc, void *data)
     ABTS_PTR_NOTNULL(tc, recvbuf);
     ogs_pkbuf_free(recvbuf);
 
-    for (i = 0; i < 5; i++) {
+    for (i = 0; i < 200; i++) {
         /*
          * Send Service request Using UplinkNASTransport
          *  - Uplink Data Status
@@ -1711,7 +1711,7 @@ static void test4_func(abts_case *tc, void *data)
     test_ue.ran_ue_ngap_id = ran_ue_ngap_id;
     test_ue.amf_ue_ngap_id = amf_ue_ngap_id;
 
-    for (i = 0; i < 5; i++) {
+    for (i = 0; i < 200; i++) {
         /*
          * Send Service request Using UplinkNASTransport
          *  - Uplink Data Status