diff --git a/src/bts.cpp b/src/bts.cpp
index ae0a1caa..608bd0e9 100644
--- a/src/bts.cpp
+++ b/src/bts.cpp
@@ -100,6 +100,7 @@ BTS::BTS()
 	: m_cur_fn(0)
 	, m_pollController(*this)
 	, m_sba(*this)
+	, m_ms_store(this)
 {
 	memset(&m_bts, 0, sizeof(m_bts));
 	INIT_LLIST_HEAD(&m_bts.ul_tbfs);
diff --git a/src/gprs_ms.cpp b/src/gprs_ms.cpp
index 1ae0fc6b..c2e83721 100644
--- a/src/gprs_ms.cpp
+++ b/src/gprs_ms.cpp
@@ -64,7 +64,8 @@ void GprsMs::timeout(void *priv_)
 	}
 }
 
-GprsMs::GprsMs(uint32_t tlli) :
+GprsMs::GprsMs(BTS *bts, uint32_t tlli) :
+	m_bts(bts),
 	m_cb(&gprs_default_cb),
 	m_ul_tbf(NULL),
 	m_dl_tbf(NULL),
@@ -101,7 +102,7 @@ GprsMs::~GprsMs()
 		m_dl_tbf->set_ms(NULL);
 		m_dl_tbf = NULL;
 	}
-	m_llc_queue.clear(NULL);
+	m_llc_queue.clear(m_bts);
 }
 
 void* GprsMs::operator new(size_t size)
diff --git a/src/gprs_ms.h b/src/gprs_ms.h
index 8d292f1e..7c71bd14 100644
--- a/src/gprs_ms.h
+++ b/src/gprs_ms.h
@@ -34,6 +34,8 @@ extern "C" {
 #include <stdint.h>
 #include <stddef.h>
 
+struct BTS;
+
 class GprsMs {
 public:
 	struct Callback {
@@ -50,7 +52,7 @@ public:
 		GprsMs * const m_ms;
 	};
 
-	GprsMs(uint32_t tlli);
+	GprsMs(BTS *bts, uint32_t tlli);
 	~GprsMs();
 
 	void set_callback(Callback *cb) {m_cb = cb;}
@@ -100,6 +102,7 @@ protected:
 	void stop_timer();
 
 private:
+	BTS *m_bts;
 	Callback * m_cb;
 	gprs_rlcmac_ul_tbf *m_ul_tbf;
 	gprs_rlcmac_dl_tbf *m_dl_tbf;
diff --git a/src/gprs_ms_storage.cpp b/src/gprs_ms_storage.cpp
index a0a32081..1f124a5d 100644
--- a/src/gprs_ms_storage.cpp
+++ b/src/gprs_ms_storage.cpp
@@ -24,7 +24,8 @@
 #include "tbf.h"
 #include "gprs_debug.h"
 
-GprsMsStorage::GprsMsStorage()
+GprsMsStorage::GprsMsStorage(BTS *bts) :
+	m_bts(bts)
 {
 }
 
@@ -86,7 +87,7 @@ GprsMs *GprsMsStorage::create_ms(uint32_t tlli, enum gprs_rlcmac_tbf_direction d
 	if (ms)
 		return ms;
 
-	ms = new GprsMs(0);
+	ms = new GprsMs(m_bts, 0);
 
 	if (dir == GPRS_RLCMAC_UL_TBF)
 		ms->set_tlli(tlli);
diff --git a/src/gprs_ms_storage.h b/src/gprs_ms_storage.h
index fff9638b..35526025 100644
--- a/src/gprs_ms_storage.h
+++ b/src/gprs_ms_storage.h
@@ -26,9 +26,11 @@
 #include <stdint.h>
 #include <stddef.h>
 
+struct BTS;
+
 class GprsMsStorage : public GprsMs::Callback {
 public:
-	GprsMsStorage();
+	GprsMsStorage(BTS *bts);
 	~GprsMsStorage();
 
 	virtual void ms_idle(class GprsMs *);
@@ -38,5 +40,6 @@ public:
 	GprsMs *create_ms(uint32_t tlli, enum gprs_rlcmac_tbf_direction dir);
 
 private:
+	BTS *m_bts;
 	LListHead<GprsMs> m_list;
 };
diff --git a/tests/ms/MsTest.cpp b/tests/ms/MsTest.cpp
index bb9e21bf..403de439 100644
--- a/tests/ms/MsTest.cpp
+++ b/tests/ms/MsTest.cpp
@@ -50,7 +50,7 @@ static void test_ms_state()
 
 	printf("=== start %s ===\n", __func__);
 
-	ms = new GprsMs(tlli);
+	ms = new GprsMs(NULL, tlli);
 	OSMO_ASSERT(ms->is_idle());
 
 	dl_tbf = talloc_zero(tall_pcu_ctx, struct gprs_rlcmac_dl_tbf);
@@ -106,7 +106,7 @@ static void test_ms_callback()
 
 	printf("=== start %s ===\n", __func__);
 
-	ms = new GprsMs(tlli);
+	ms = new GprsMs(NULL, tlli);
 	ms->set_callback(&cb);
 
 	OSMO_ASSERT(ms->is_idle());
@@ -175,7 +175,7 @@ static void test_ms_replace_tbf()
 
 	printf("=== start %s ===\n", __func__);
 
-	ms = new GprsMs(tlli);
+	ms = new GprsMs(NULL, tlli);
 	ms->set_callback(&cb);
 
 	OSMO_ASSERT(ms->is_idle());
@@ -242,7 +242,7 @@ static void test_ms_change_tlli()
 
 	printf("=== start %s ===\n", __func__);
 
-	ms = new GprsMs(start_tlli);
+	ms = new GprsMs(NULL, start_tlli);
 
 	OSMO_ASSERT(ms->is_idle());
 
@@ -334,7 +334,7 @@ static void test_ms_storage()
 
 	gprs_rlcmac_ul_tbf *ul_tbf;
 	GprsMs *ms, *ms_tmp;
-	GprsMsStorage store;
+	GprsMsStorage store(NULL);
 
 	printf("=== start %s ===\n", __func__);
 
@@ -423,7 +423,7 @@ static void test_ms_timeout()
 
 	printf("=== start %s ===\n", __func__);
 
-	ms = new GprsMs(tlli);
+	ms = new GprsMs(NULL, tlli);
 	ms->set_callback(&cb);
 	ms->set_timeout(1);