Function expand_upwards() did not guarded against wrapping
around to address 0. This fixes the adjtimex02 testcase from
the Linux Test Project on a 32bit PARISC kernel.
[expand_upwards is only used on parisc and ia64; it looks like it does
the right thing on both. --kyle]