I put this up on AOSP Gerrit at https://android-review.googlesource.com/#/c/48233/ with a minor change to the semaphore field name to be more descriptive and to identify it as a semaphore.
After some out-of-band discussion it was agreed the race with the idle notifier definitely exists, but the race described with the timer function is unclear. As I understand it, del_timer_sync() spins waiting for the timer to stop running (and possibly rescheduling itself) and then deletes the timer. When try_to_del_timer_sync() returns successfully "the timer is not queued and the handler is not running on any CPU". Is there still a race here anyway?
Todd