syzbot


KASAN: slab-use-after-free Read in l2cap_recv_frame

Status: upstream: reported C repro on 2024/04/27 07:44
Subsystems: bluetooth
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+5c915dc5dd417b83b348@syzkaller.appspotmail.com
First crash: 775d, last: 51d
Cause bisection: the cause commit could be any of (bisect log):
  b79e04091010 Bluetooth: btintel: Fix null ptr deref in btintel_read_version
  e7b02296fb40 Bluetooth: Remove BT_HS
  
Fix bisection: the issue occurs on the latest tested release (bisect log)
  
✨ AI Jobs (3)
ID Workflow Result Correct Bug Created Started Finished Revision Error
825aab7c-6ccf-43c2-9a0a-e569b0e10f19 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ✅ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ KASAN: slab-use-after-free Read in l2cap_recv_frame 2026/05/24 13:42 2026/05/24 13:42 2026/05/24 14:23 c69befb30ac10e158cc9d1557b508ee3f0eca1de
1973afdb-d0e7-48ba-a300-b293da73f5ef patching-compressed 💥 KASAN: slab-use-after-free Read in l2cap_recv_frame 2026/05/16 14:07 2026/05/16 14:07 2026/05/16 14:38 de5aae85e5f28e2fa1c7deefcc24fe286abe5140 Kernel failed to boot: kernel panic: System is deadlocked on memory skbuff_small_head 42KB 63KB skbuff_head_cache 14KB 16KB mem_cgroup_per_node 24KB 63KB mem_cgroup 27KB 31KB proc_dir_entry 45KB 47KB shmem_inode_cache 39KB 61KB kernfs_node_cache 127KB 127KB mnt_cache 21KB 31KB key_jar 7KB 8KB nsproxy 4KB 7KB files_cache 21KB 31KB signal_cache 40KB 47KB sighand_cache 76KB 95KB numa_policy 2KB 3KB trace_event_file 405KB 405KB ftrace_event_field 652KB 654KB pool_workqueue 55KB 64KB maple_node 16KB 16KB mm_struct 21KB 31KB vmap_area 8KB 15KB kmalloc-cg-8k 256KB 256KB kmalloc-cg-2k 26KB 64KB kmalloc-cg-512 28KB 32KB kmalloc-cg-256 28KB 32KB kmalloc-cg-128 15KB 16KB kmalloc-cg-64 7KB 8KB kmalloc-cg-32 1KB 4KB kmalloc-cg-16 0KB 4KB kmalloc-cg-8 0KB 8KB kmalloc-cg-192 22KB 23KB kmalloc-cg-96 5KB 7KB kmalloc-8k 64KB 64KB kmalloc-4k 28KB 64KB kmalloc-2k 72KB 96KB kmalloc-1k 88KB 96KB kmalloc-512 128KB 136KB kmalloc-256 48KB 52KB kmalloc-128 17KB 24KB kmalloc-64 25KB 28KB kmalloc-32 6KB 8KB kmalloc-16 2KB 8KB kmalloc-8 1KB 8KB kmalloc-192 23KB 27KB kmalloc-96 16KB 19KB kmem_cache_node 13KB 16KB kmem_cache 27KB 36KB Memory cgroup min protection 0kB -- low protection 0kB Tasks state (memory values in pages): [ pid ] uid tgid total_vm rss rss_anon rss_file rss_shmem pgtables_bytes swapents oom_score_adj name Out of memory and no killable processes... Kernel panic - not syncing: System is deadlocked on memory CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted syzkaller #1 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> __dump_stack+0x26/0x30 lib/dump_stack.c:94 dump_stack_lvl+0x50/0x1c0 lib/dump_stack.c:120 dump_stack+0x1e/0x25 lib/dump_stack.c:129 vpanic+0x7b4/0x1430 kernel/panic.c:650 panic+0x15d/0x160 kernel/panic.c:787 out_of_memory+0x1d47/0x1f50 mm/oom_kill.c:1166 __alloc_pages_may_oom+0x2b4/0x510 mm/page_alloc.c:4116 __alloc_pages_slowpath+0xceb/0x18c0 mm/page_alloc.c:4914 __alloc_frozen_pages_noprof+0x596/0xb20 mm/page_alloc.c:5239 alloc_pages_mpol+0x328/0x860 mm/mempolicy.c:2490 alloc_frozen_pages_noprof mm/mempolicy.c:2561 [inline] alloc_pages_noprof+0x101/0x290 mm/mempolicy.c:2581 kmsan_ioremap_page_range+0xd9/0x310 mm/kmsan/hooks.c:164 vmap_page_range mm/vmalloc.c:341 [inline] ioremap_page_range+0xb0f/0xb50 mm/vmalloc.c:363 __ioremap_caller+0x8cc/0xbd0 arch/x86/mm/ioremap.c:301 ioremap+0x3f/0x50 arch/x86/mm/ioremap.c:355 mcfg_ioremap arch/x86/pci/mmconfig_64.c:108 [inline] pci_mmcfg_arch_map+0xd1/0x270 arch/x86/pci/mmconfig_64.c:116 pci_mmcfg_arch_init+0x7d/0x110 arch/x86/pci/mmconfig_64.c:138 __pci_mmcfg_init+0xb0/0x290 arch/x86/pci/mmconfig-shared.c:705 pci_mmcfg_early_init+0xb0/0xd0 arch/x86/pci/mmconfig-shared.c:724 pci_arch_init+0x104/0x220 arch/x86/pci/init.c:17 do_one_initcall+0x237/0xb30 init/main.c:1392 do_initcall_level+0x157/0x330 init/main.c:1454 do_initcalls+0x176/0x310 init/main.c:1470 do_basic_setup+0x22/0x30 init/main.c:1490 kernel_init_freeable+0x213/0x460 init/main.c:1703 kernel_init+0x2f/0x5e0 init/main.c:1593 ret_from_fork+0x20f/0x8d0 ar
94e614e4-bfef-462e-b229-38b5aebe1523 patching-compressed 💥 KASAN: slab-use-after-free Read in l2cap_recv_frame 2026/05/15 21:23 2026/05/15 21:43 2026/05/15 21:43 efdaf0f9b8bfc56ea6d17bea15a64f4591cc712d flow inputs are missing: patching.Inputs: field "StraceBin" is not present when converting map
Discussions (4)
Title Replies (including bot) Last reply
[syzbot] Monthly bluetooth report (Sep 2025) 0 (1) 2025/09/24 12:39
[syzbot] Monthly bluetooth report (Feb 2025) 0 (1) 2025/02/17 12:44
[syzbot] Monthly bluetooth report (Oct 2024) 0 (1) 2024/10/15 08:33
[syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_recv_frame 2 (6) 2024/09/01 12:33
Last patch testing requests (12)
Created Duration User Patch Repo Result
2026/04/17 09:28 36m retest repro upstream report log
2026/04/17 09:28 21m retest repro upstream report log
2026/04/02 15:27 39m retest repro upstream report log
2026/02/06 04:04 47m retest repro upstream report log
2026/02/06 04:04 21m retest repro upstream report log
2026/01/22 15:05 0m retest repro upstream error
2025/11/28 02:46 22m retest repro upstream report log
2025/11/28 02:46 22m retest repro upstream report log
2025/09/18 18:30 21m retest repro upstream report log
2025/09/18 18:30 40m retest repro upstream report log
2024/09/01 11:14 35m hdanton@sina.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git e8784b0aef62 OK log
2024/09/01 09:04 53m hdanton@sina.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git e8784b0aef62 report log

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in l2cap_conless_channel net/bluetooth/l2cap_core.c:6772 [inline]
BUG: KMSAN: uninit-value in l2cap_recv_frame+0xc3ae/0x187c0 net/bluetooth/l2cap_core.c:6846
 l2cap_conless_channel net/bluetooth/l2cap_core.c:6772 [inline]
 l2cap_recv_frame+0xc3ae/0x187c0 net/bluetooth/l2cap_core.c:6846
 l2cap_recv_acldata+0xe91/0x1de0 net/bluetooth/l2cap_core.c:7574
 hci_acldata_packet net/bluetooth/hci_core.c:3854 [inline]
 hci_rx_work+0x688/0xfc0 net/bluetooth/hci_core.c:4081
 process_one_work kernel/workqueue.c:3257 [inline]
 process_scheduled_works+0xb91/0x1d80 kernel/workqueue.c:3340
 worker_thread+0xedf/0x1590 kernel/workqueue.c:3421
 kthread+0xd5c/0xf00 kernel/kthread.c:463
 ret_from_fork+0x208/0x710 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

Uninit was stored to memory at:
 l2cap_recv_frame+0xc3a7/0x187c0 net/bluetooth/l2cap_core.c:6844
 l2cap_recv_acldata+0xe91/0x1de0 net/bluetooth/l2cap_core.c:7574
 hci_acldata_packet net/bluetooth/hci_core.c:3854 [inline]
 hci_rx_work+0x688/0xfc0 net/bluetooth/hci_core.c:4081
 process_one_work kernel/workqueue.c:3257 [inline]
 process_scheduled_works+0xb91/0x1d80 kernel/workqueue.c:3340
 worker_thread+0xedf/0x1590 kernel/workqueue.c:3421
 kthread+0xd5c/0xf00 kernel/kthread.c:463
 ret_from_fork+0x208/0x710 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4960 [inline]
 slab_alloc_node mm/slub.c:5263 [inline]
 kmem_cache_alloc_node_noprof+0x9e7/0x17a0 mm/slub.c:5315
 kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:586
 __alloc_skb+0x805/0x1040 net/core/skbuff.c:690
 alloc_skb include/linux/skbuff.h:1383 [inline]
 bt_skb_alloc include/net/bluetooth/bluetooth.h:510 [inline]
 vhci_get_user drivers/bluetooth/hci_vhci.c:496 [inline]
 vhci_write+0x125/0x960 drivers/bluetooth/hci_vhci.c:616
 new_sync_write fs/read_write.c:593 [inline]
 vfs_write+0xbe2/0x15d0 fs/read_write.c:686
 ksys_write fs/read_write.c:738 [inline]
 __do_sys_write fs/read_write.c:749 [inline]
 __se_sys_write fs/read_write.c:746 [inline]
 __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746
 x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 51 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(none) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: hci0 hci_rx_work
=====================================================

Crashes (140):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/08 13:52 upstream f0b9d8eb98df d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2025/01/22 09:59 upstream 9f3ee94e705a da72ac06 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/09/01 07:39 upstream e8784b0aef62 1eda0d14 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/09/19 20:01 upstream 2a17bb8c204f 6f888b75 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in l2cap_recv_frame
2024/08/23 08:11 upstream aa0743a22936 ce8a9099 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in l2cap_recv_frame
2024/08/15 14:47 upstream 1fb918967b56 e4bacdaf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in l2cap_recv_frame
2024/07/18 21:28 upstream b1bc554e009e 7403ec00 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: slab-use-after-free Read in l2cap_recv_frame
2024/07/08 04:16 upstream 256abd8e550c bc4ebbb5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-use-after-free Read in l2cap_recv_frame
2024/04/23 07:37 upstream 4d2008430ce8 21339d7b .config console log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: slab-use-after-free Read in l2cap_recv_frame
2025/01/30 02:34 upstream 05dbaf8dd8bf afe4eff5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2025/01/22 21:44 upstream c4b9570cfb63 25e17fd3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2025/01/22 08:01 upstream 9f3ee94e705a da72ac06 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/10/11 12:28 upstream 1d227fcc7222 cd942402 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/10/09 02:40 upstream 5b7c893ed5ed 402f1df0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/10/07 08:34 upstream 8cf0b93919e1 d7906eff .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/10/07 08:34 upstream 8cf0b93919e1 d7906eff .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/10/05 14:37 upstream 27cc6fdf7201 d7906eff .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/10/04 08:14 upstream 0c559323bbaa d7906eff .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/10/03 21:38 upstream 7ec462100ef9 d7906eff .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/09/26 12:54 upstream aa486552a110 0d19f247 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/09/25 04:42 upstream 97d8894b6f4c 5643e0e9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/09/04 16:51 upstream 88fac17500f4 9d47f20a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/09/04 07:27 upstream 88fac17500f4 9d47f20a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/09/01 05:25 upstream e8784b0aef62 1eda0d14 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/09/01 05:24 upstream e8784b0aef62 1eda0d14 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/08/28 05:01 upstream 3ec3f5fc4a91 6c853ff9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/08/27 16:14 upstream 3e9bff3bbe13 9aee4e0b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/08/26 20:19 upstream 5be63fc19fca 9aee4e0b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/08/26 12:47 upstream 5be63fc19fca d7d32352 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/08/26 10:13 upstream 5be63fc19fca d7d32352 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/08/20 06:40 upstream b0da640826ba 9f0ab3fb .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/08/18 22:28 upstream c3f2d783a459 dbc93b08 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/08/17 19:21 upstream e5fa841af679 dbc93b08 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/08/17 00:36 upstream d7a5aa4b3c00 76120936 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/08/16 22:56 upstream d7a5aa4b3c00 76120936 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/08/13 01:56 upstream d74da846046a 7b0f4b46 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/08/12 23:36 upstream d74da846046a 7b0f4b46 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/08/12 03:01 upstream 7006fe2f7f78 6f4edef4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/08/11 18:10 upstream 5189dafa4cf9 6f4edef4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/08/11 18:09 upstream 5189dafa4cf9 6f4edef4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/08/11 14:56 upstream 5189dafa4cf9 6f4edef4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2024/08/08 15:43 upstream 6a0e38264012 de12cf65 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_recv_frame
2025/06/08 06:44 upstream 5b032cac6225 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in l2cap_recv_frame
2025/02/04 16:22 upstream 0de63bb7d919 8f267cef .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in l2cap_recv_frame
2024/10/11 18:18 upstream 1d227fcc7222 cd942402 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in l2cap_recv_frame
2024/10/09 07:14 upstream 5b7c893ed5ed 402f1df0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in l2cap_recv_frame
2024/10/07 20:54 upstream 8cf0b93919e1 d7906eff .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in l2cap_recv_frame
2024/10/04 14:08 upstream 3840cbe24cf0 d7906eff .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in l2cap_recv_frame
2024/10/04 12:52 upstream 3840cbe24cf0 d7906eff .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in l2cap_recv_frame
2024/09/25 00:08 upstream abf2050f51fd 5643e0e9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in l2cap_recv_frame
2024/08/17 05:00 upstream 670c12ce09a8 76120936 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in l2cap_recv_frame
2024/08/16 12:25 upstream d7a5aa4b3c00 e4bacdaf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in l2cap_recv_frame
2024/08/13 05:56 upstream 7c626ce4bae1 7b0f4b46 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in l2cap_recv_frame
2024/08/12 07:42 upstream 7006fe2f7f78 6f4edef4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in l2cap_recv_frame
2024/08/12 06:29 upstream 7006fe2f7f78 6f4edef4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in l2cap_recv_frame
* Struck through repros no longer work on HEAD.