The dmesg output you posted confirms that max_low_pfn is indeed 0x373fe, and it appears
that the value of phys_mem being checked mat be 0x3f401ff1, which translates to pfn 0x3f401,
at least if what's still in registers can be believed.
Since that is indeed greater than max_low_pfn, VIRTUAL_BUG_ON triggers:
VIRTUAL_BUG_ON((phys_addr >> PAGE_SHIFT) > max_low_pfn);
Looking at the call stack of
copy_strings_0x220
__check_object_size+0xef
that looks to translate to this sequence:
copy_from_user(kaddr+offset, str, bytes_to_copy)
check_copy_size(kaddr+offset, bytes_to_copy, FALSE)
check_object_size(kaddr+offset, bytes_to_copy, FALSE)
__check_object_size(kaddr+offset, bytes_to_copy, FALSE)
check_heap_object(kaddr+offset, bytes_to_copy, FALSE)
virt_to_head_page(kaddr+offset)
virt_to_page(kaddr+offset)
pfn_to_page(kaddr+offset)
__pa(kaddr+offset)
__phys_addr(kaddr+offset)
so it appears the address is "too high" for low memory at that point.
