safe_read() and safe_write() return ssize_t just like read() and write()