possible for the timeout to expire just*before* the del_timer() call
super nit: "just*before* the" - needs a whitespace before "before" :)
Weird... the original patch file here and the copy received by lore via linux-iommu look fine, gremlins in your MUA or delivery path perhaps?