mm: fix possible off-by-one in walk_pte_range()