diff --git a/common/include/tfe_ctrl_packet.h b/common/include/tfe_ctrl_packet.h
index 162b142..c8a3777 100644
--- a/common/include/tfe_ctrl_packet.h
+++ b/common/include/tfe_ctrl_packet.h
@@ -42,6 +42,8 @@ void ctrl_packet_parser_init(struct ctrl_pkt_parser *handler);
 int ctrl_packet_parser_parse(void *ctx, const char* data, size_t length, void *logger);
 void ctrl_packet_parser_dump(struct ctrl_pkt_parser *handler, void *logger);
 
+void ctrl_packet_cmsg_destroy(struct ctrl_pkt_parser *handler);
+
 #ifdef __cpluscplus
 }
 #endif
diff --git a/common/src/tfe_cmsg.cpp b/common/src/tfe_cmsg.cpp
index 6f9d2b6..a7e0969 100644
--- a/common/src/tfe_cmsg.cpp
+++ b/common/src/tfe_cmsg.cpp
@@ -46,9 +46,9 @@ struct tfe_cmsg* tfe_cmsg_init()
 
 	pthread_rwlock_init(&(cmsg->rwlock), NULL);
 
-	ATOMIC_ZERO(&cmsg->flag);
-	ATOMIC_ZERO(&cmsg->ref);
-	ATOMIC_INC(&cmsg->ref);
+	ATOMIC_ZERO(&(cmsg->flag));
+	ATOMIC_ZERO(&(cmsg->ref));
+	ATOMIC_INC(&(cmsg->ref));
 	return cmsg;
 }
 
@@ -261,6 +261,9 @@ int tfe_cmsg_deserialize(const unsigned char *data, uint16_t len, struct tfe_cms
 
 	cmsg = ALLOC(struct tfe_cmsg, 1);
 	pthread_rwlock_init(&(cmsg->rwlock), NULL);
+	ATOMIC_ZERO(&(cmsg->flag));
+	ATOMIC_ZERO(&(cmsg->ref));
+	ATOMIC_INC(&(cmsg->ref));
 	offset = sizeof(struct tfe_cmsg_serialize_header);
 	nr_tlvs = ntohs(header->nr_tlvs);
 	for(int i = 0; i < nr_tlvs; i++)
diff --git a/common/src/tfe_ctrl_packet.cpp b/common/src/tfe_ctrl_packet.cpp
index c535857..206eb96 100644
--- a/common/src/tfe_ctrl_packet.cpp
+++ b/common/src/tfe_ctrl_packet.cpp
@@ -297,6 +297,8 @@ int ctrl_packet_parser_parse(void *ctx, const char* data, size_t length, void *l
         goto error;
     }
 
+    handler->cmsg = tfe_cmsg_init();
+    tfe_cmsg_dup(handler->cmsg);
     proxy_map = mpack_node_map_cstr(params, "proxy");
     ret = proxy_parse_messagepack(proxy_map, handler, logger);
     if (ret != 0)
@@ -307,6 +309,8 @@ succ:
     return 0;
 error:
     mpack_tree_destroy(&tree);
+    tfe_cmsg_destroy(handler->cmsg);
+    tfe_cmsg_destroy(handler->cmsg);
     return -1;
 }
 
@@ -330,8 +334,14 @@ const char *session_state_to_string(enum session_state state)
 void ctrl_packet_parser_init(struct ctrl_pkt_parser *handler)
 {
     memset(handler, 0, sizeof(struct ctrl_pkt_parser));
-    handler->cmsg = tfe_cmsg_init();
-    tfe_cmsg_dup(handler->cmsg);
+}
+
+void ctrl_packet_cmsg_destroy(struct ctrl_pkt_parser *handler)
+{
+    if (handler) {
+        tfe_cmsg_destroy(handler->cmsg);
+        tfe_cmsg_destroy(handler->cmsg);
+    }
 }
 
 void ctrl_packet_parser_dump(struct ctrl_pkt_parser *handler, void *logger)
diff --git a/common/src/tfe_packet_io.cpp b/common/src/tfe_packet_io.cpp
index 34bee10..8895b62 100644
--- a/common/src/tfe_packet_io.cpp
+++ b/common/src/tfe_packet_io.cpp
@@ -195,6 +195,46 @@ static int tap_write(int tap_fd, const char *data, int data_len, void *logger)
     return ret;
 }
 
+static struct metadata *metadata_new()
+{
+    struct metadata *meta = (struct metadata *)calloc(1, sizeof(struct metadata));
+
+    return meta;
+}
+
+static int metadata_is_empty(struct metadata *meta)
+{
+    return meta->write_ref == 0 ? 1 : 0;
+}
+
+static void metadata_deep_copy(struct metadata *dst, struct metadata *src)
+{
+    dst->write_ref++;
+    dst->session_id = src->session_id;
+    dst->raw_data = (char *)calloc(src->raw_len, sizeof(char));
+    memcpy(dst->raw_data, src->raw_data, src->raw_len);
+    dst->raw_len = src->raw_len;
+    dst->l7offset = src->l7offset;
+    dst->is_e2i_dir = src->is_e2i_dir;
+    dst->is_ctrl_pkt = src->is_ctrl_pkt;
+    dst->is_decrypted = src->is_decrypted;
+}
+
+void metadata_free(struct metadata *meta)
+{
+    if (meta)
+    {
+        if (meta->raw_data)
+        {
+            free(meta->raw_data);
+            meta->raw_data = NULL;
+        }
+
+        free(meta);
+        meta = NULL;
+    }
+}
+
 static struct session_ctx *session_ctx_new()
 {
     struct session_ctx *ctx = (struct session_ctx *)calloc(1, sizeof(struct session_ctx));
@@ -211,8 +251,26 @@ static void session_ctx_free(struct session_ctx *ctx)
             tfe_cmsg_destroy(ctx->cmsg);
         }
 
+        if (ctx->raw_meta_i2e)
+        {
+            metadata_free(ctx->raw_meta_i2e);
+            ctx->raw_meta_i2e = NULL;
+        }
+
+        if (ctx->raw_meta_e2i)
+        {
+            metadata_free(ctx->raw_meta_e2i);
+            ctx->raw_meta_e2i = NULL;
+        }
+
+        if (ctx->ctrl_meta)
+        {
+            metadata_free(ctx->ctrl_meta);
+            ctx->ctrl_meta = NULL;
+        }
+
         free(ctx);
-        ctx = 0;
+        ctx = NULL;
     }
 }
 
@@ -501,31 +559,6 @@ static int overwrite_tcp_mss(struct tfe_cmsg *cmsg, struct tcp_restore_info *res
 	return 0;
 }
 
-static struct metadata *metadata_new()
-{
-    struct metadata *meta = (struct metadata *)calloc(1, sizeof(struct metadata));
-
-    return meta;
-}
-
-static int metadata_is_empty(struct metadata *meta)
-{
-    return meta->write_ref == 0 ? 1 : 0;
-}
-
-static void metadata_deep_copy(struct metadata *dst, struct metadata *src)
-{
-    dst->write_ref++;
-    dst->session_id = src->session_id;
-    dst->raw_data = (char *)calloc(src->raw_len, sizeof(char));
-    memcpy(dst->raw_data, src->raw_data, src->raw_len);
-    dst->raw_len = src->raw_len;
-    dst->l7offset = src->l7offset;
-    dst->is_e2i_dir = src->is_e2i_dir;
-    dst->is_ctrl_pkt = src->is_ctrl_pkt;
-    dst->is_decrypted = src->is_decrypted;
-}
-
 static int tcp_restore_set_from_cmsg(struct tfe_cmsg *cmsg, struct tcp_restore_info *restore_info)
 {
     int ret = 0;
@@ -1270,8 +1303,7 @@ static int handle_session_opening(struct metadata *meta, struct ctrl_pkt_parser
     ATOMIC_INC(&(packet_io_fs->session_num));
     return 0;
 end:
-    if (parser->cmsg)
-        free(parser->cmsg);
+    ctrl_packet_cmsg_destroy(parser);
     return -1;
 }
 
@@ -1358,6 +1390,7 @@ static int handle_control_packet(struct packet_io *handle, marsio_buff_t *rx_buf
     if (ctrl_parser.session_id != meta.session_id)
     {
         TFE_LOG_ERROR(logger, "%s: unexpected control packet, metadata's session %lu != control packet's session %lu", LOG_TAG_PKTIO, meta.session_id, ctrl_parser.session_id);
+        ctrl_packet_cmsg_destroy(&ctrl_parser);
         return -1;
     }
 
@@ -1505,8 +1538,13 @@ void tfe_tap_ctx_destory(struct tap_ctx *handler)
         tap_close(handler->tap_fd);
         tap_close(handler->tap_c);
         tap_close(handler->tap_s);
+        if (handler->buff) {
+            free(handler->buff);
+            handler->buff = NULL;
+        }
 
         free(handler);
+        handler = NULL;
     }
 }
 
diff --git a/common/src/tfe_packet_io_fs.cpp b/common/src/tfe_packet_io_fs.cpp
index 0a31e8a..0ac23bd 100644
--- a/common/src/tfe_packet_io_fs.cpp
+++ b/common/src/tfe_packet_io_fs.cpp
@@ -120,7 +120,7 @@ static const char *stat_map[] =
     [STAT_CONTROL_TX_B] = "ctrl_tx_B",
 
     [STAT_CTRL_PKT_OPENING] = "ctrl_pkt_open",
-    [STAT_CTRL_PKT_ACTIVE] = "ctrl_pkt_avtive",
+    [STAT_CTRL_PKT_ACTIVE] = "ctrl_pkt_active",
     [STAT_CTRL_PKT_CLOSING] = "ctrl_pkt_close",
     [STAT_CTRL_PKT_RESETALL] = "ctrl_pkt_reset",
     [STAT_CTRL_PKT_ERROR] = "ctrl_pkt_error",
diff --git a/platform/src/acceptor_kni_v4.cpp b/platform/src/acceptor_kni_v4.cpp
index 401060f..a405357 100644
--- a/platform/src/acceptor_kni_v4.cpp
+++ b/platform/src/acceptor_kni_v4.cpp
@@ -169,7 +169,7 @@ struct acceptor_kni_v4 *acceptor_kni_v4_create(struct tfe_proxy *proxy, const ch
     g_packet_io_logger = packet_io_logger;
     struct acceptor_kni_v4 *acceptor_ctx = acceptor_ctx_create(profile, packet_io_logger);
     if (acceptor_ctx == NULL)
-        goto error_out;
+        return NULL;
 
     acceptor_ctx->ref_proxy = proxy;
     for (int i = 0; i < acceptor_ctx->nr_worker_threads; i++) {