cgroup: fix an off-by-one bug which may trigger BUG_ON()