diff --git a/src/stream-tcp.c b/src/stream-tcp.c
index 72fb4eda9b..a0517f3a4b 100644
--- a/src/stream-tcp.c
+++ b/src/stream-tcp.c
@@ -5723,6 +5723,8 @@ void StreamTcpPseudoPacketCreateStreamEndPacket(ThreadVars *tv, StreamTcpThread
  * \note when stream engine is running in inline mode all segments are used,
  *       in IDS/non-inline mode only ack'd segments are iterated.
  *
+ * \note Must be called under flow lock.
+ *
  * \return -1 in case of error, the number of segment in case of success
  *
  */
@@ -5736,11 +5738,9 @@ int StreamTcpSegmentForEach(const Packet *p, uint8_t flag, StreamSegmentCallback
     if (p->flow == NULL)
         return 0;
 
-    FLOWLOCK_RDLOCK(p->flow);
     ssn = (TcpSession *)p->flow->protoctx;
 
     if (ssn == NULL) {
-        FLOWLOCK_UNLOCK(p->flow);
         return 0;
     }
 
@@ -5758,13 +5758,11 @@ int StreamTcpSegmentForEach(const Packet *p, uint8_t flag, StreamSegmentCallback
         ret = CallbackFunc(p, data, seg->payload, seg->payload_len);
         if (ret != 1) {
             SCLogDebug("Callback function has failed");
-            FLOWLOCK_UNLOCK(p->flow);
             return -1;
         }
         seg = seg->next;
         cnt++;
     }
-    FLOWLOCK_UNLOCK(p->flow);
     return cnt;
 }
 
diff --git a/src/stream.c b/src/stream.c
index 8aabd6dcae..6415420981 100644
--- a/src/stream.c
+++ b/src/stream.c
@@ -268,6 +268,8 @@ void StreamMsgReturnListToPool(void *list)
 }
 
 /** \brief Run callback for all segments
+ *
+ * Must be called under flow lock.
  *
  * \return -1 in case of error, the number of segment in case of success
  */