mm: fix overflow check in expand_upwards()