tm: unlink cell and its timer in free function if structure still linked in clist

modules/tm/h_table.c

@@ -125,6 +125,11 @@ void free_cell_helper( struct cell* dead_cell, const char *fname, unsigned int f
 
 	LM_DBG("freeing transaction %p from %s:%u\n", dead_cell, fname, fline);
 
+	if(dead_cell->prev_c!=NULL && dead_cell->next_c!=NULL) {
+		LM_WARN("removed cell %p is still linked in hash table\n", dead_cell);
+		unlink_timers(dead_cell);
+		remove_from_hash_table_unsafe(dead_cell);
+	}
 	release_cell_lock( dead_cell );
 	if (unlikely(has_tran_tmcbs(dead_cell, TMCB_DESTROY)))
 		run_trans_callbacks(TMCB_DESTROY, dead_cell, 0, 0, 0);

modules/tm/t_lookup.c

@@ -1568,7 +1568,7 @@ int t_lookup_ident(struct cell ** trans, unsigned int hash_index,
 		prefetch_loc_r(p_cell->next_c, 1);
 		if(p_cell->label == label){
 			REF_UNSAFE(p_cell);
-    			UNLOCK_HASH(hash_index);
+			UNLOCK_HASH(hash_index);
 			set_t(p_cell, T_BR_UNDEFINED);
 			*trans=p_cell;
 			DBG("DEBUG: t_lookup_ident: transaction found\n");