On the quest to remove all VLAs from the kernel[1], this switches to
a pair of kmalloc regions instead of using the stack. This also moves
the get_random_bytes() after all allocations (and drops the needless
"nbytes" variable).
[1]https://lkml.org/lkml/2018/3/7/621
Signed-off-by: Kees Cook<keescook@xxxxxxxxxxxx>