is it safe to start a new transaction when in a interrupt handler ?

Yep, i2c_transfer and most of the other functions in the i2c API that
wrap the implementations already lock for you.

Why do you multiply by * msg->len ?

I thought it might make sense to make timeout proportional to message
length, so their would be a timeout per byte, like what the hardware
already does. I guess we should just leave that up to the user to
determine on their own?

use devm_kzalloc() may be ?

Whoops, good catch. Will update in next version.