This works, but maybe we can make things a little easier. At the beginning of SigMatchSignatures we retrieve alstate, alproto, alversion from the flow while the flow is locked. Maybe we can get this as well:
<pre>
                alstate = AppLayerGetProtoStateFromPacket(p);
                alproto = AppLayerGetProtoFromPacket(p);
                alversion = AppLayerGetStateVersion(p->flow);
new ->      has_state = DeStateFlowHasInspectableState(p->flow, alproto, alversion, flags);
</pre>
Then we can leave the flow locking out of this func too. Although we then do get the de_state lock while holding the flow lock. Maybe it won't work...