take RCU-dependent stuff around exec_permission() into a new helper