GCC (pedantically, but correctly) considers that a negative ssize_t may
become positive when casted to int.  This may cause uninitialized variable
warnings when a function returns such a negative ssize_t and is inlined.
Propagate ssize_t return types to avoid this.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>