Signed uoffset/bytes in copy routines let negative values bypass EFAULT guard

Summary

All 4 copy routines take int uoffset,bytes. Guard if(uoffset+bytes>xio_bytes) passes for negative uoffset (e.g. -1+1=0 not>xio_bytes). Page index (xio_offset+uoffset)>>PAGE_SHIFT goes negative -> xio_pages[i] reads before array start. No current in-tree trigger.