diff --git a/qemu/target/riscv/pmp.c b/qemu/target/riscv/pmp.c
index b11c4ae2..a2fcc90d 100644
--- a/qemu/target/riscv/pmp.c
+++ b/qemu/target/riscv/pmp.c
@@ -246,7 +246,7 @@ bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
          from low to high */
     for (i = 0; i < MAX_RISCV_PMPS; i++) {
         s = pmp_is_in_range(env, i, addr);
-        e = pmp_is_in_range(env, i, addr + size);
+        e = pmp_is_in_range(env, i, addr + size - 1);
 
         /* partially inside */
         if ((s + e) == 1) {