Index: kernel/generic/src/ipc/ipc.c
===================================================================
--- kernel/generic/src/ipc/ipc.c	(revision f9bd2e3e073db3093492a744250c4efaab427fd4)
+++ kernel/generic/src/ipc/ipc.c	(revision d891cba81ad1b34054ca7c7caa8e59077dbb988d)
@@ -626,12 +626,15 @@
 restart:
 	/*
-	 * Go through all phones, until they are all FREE. Locking is not
-	 * needed, no one else should modify it when we are in cleanup
+	 * Go through all phones, until they are all free.
+	 * Locking is needed as there may be connection handshakes in progress.
 	 */
 	for (i = 0; i < IPC_MAX_PHONES; i++) {
-		if (TASK->phones[i].state == IPC_PHONE_HUNGUP &&
-		    atomic_get(&TASK->phones[i].active_calls) == 0) {
-			TASK->phones[i].state = IPC_PHONE_FREE;
-			TASK->phones[i].callee = NULL;
+		phone_t *phone = &TASK->phones[i];
+
+		mutex_lock(&phone->lock);	
+		if ((phone->state == IPC_PHONE_HUNGUP) &&
+		    (atomic_get(&phone->active_calls) == 0)) {
+			phone->state = IPC_PHONE_FREE;
+			phone->callee = NULL;
 		}
 
@@ -645,7 +648,8 @@
 		 * phone.
 		 */
-		if ((TASK->phones[i].state == IPC_PHONE_CONNECTED) ||
-		    (TASK->phones[i].state == IPC_PHONE_SLAMMED)) {
-			ipc_phone_hangup(&TASK->phones[i]);
+		if ((phone->state == IPC_PHONE_CONNECTED) ||
+		    (phone->state == IPC_PHONE_SLAMMED)) {
+			mutex_unlock(&phone->lock);
+			ipc_phone_hangup(phone);
 			/*
 			 * Now there may be one extra active call, which needs
@@ -660,6 +664,10 @@
 		 * IPC is now in HUNGUP state, we wait for the reply to come
 		 */
-		if (TASK->phones[i].state != IPC_PHONE_FREE)
+		if (phone->state != IPC_PHONE_FREE) {
+			mutex_unlock(&phone->lock);
 			break;
+		}
+
+		mutex_unlock(&phone->lock);
 	}
 		
@@ -671,5 +679,4 @@
 	    SYNCH_FLAGS_NONE);
 	ASSERT(call->flags & (IPC_CALL_ANSWERED | IPC_CALL_NOTIF));
-		
 	ipc_call_free(call);
 	goto restart;