Hello indeed. I'm catching up on a week away...
[ Regarding del_timer_sync() ]
> Alas, it has fatal bug. Namely, timer handler _code_ can be released
> in between timer_exit() and return from handler. It is utterly
> unlikely, but the bug is fatal. 8) I do not know how to repair
> this without refcounts.
Why does the handler have to call timer_exit() at all?
Could we not clear timer->running in run_timer_list()? That would
certainly protect us from the problem you identify...