27 June 2019

Forkbomb in WSL

Today, I wondered what would happen if run a fork bomb in Windows Subsystem for Linux (WSL). After a brief discussion with a co-worker, I hypothesised that it crashes the WSL runtime and the Bash console whereas my co-worker thought that Windows would either run out of memory or out of PIDs and thus become unstable and crash. He guessed that no ulimit is at play by default. We bet a beer on it - the game was on!

I opened my Ubuntu WSL console (note, this is still the first version of WSL, not WSL 2) and entered one of the more well-known versions of the fork bomb:

:(){ :|:& };:

Initially, not much happened. Then, the Windows memory usage jumped from 11GB up to 24GB (my machine has 32GB so that's still okay). Then my task manager window started to act up:

I was able to take a screenshot, but I had to press the print screen button twice for it to do anything. After that, the system seemed to have regained some stability. Memory usage was still around 24GB. I closed the WSL console and told the co-worker that the problems definitely appeared in Windows, but I was still unsure who won. A couple of seconds later, my mouse pointer froze and so did the entire machine. A hard reset was necessary to get the machine responsive again. The result is clear, I lost that beer. Well played.

What did I learn? WSL really is just a thin layer between the Linux binaries and the Windows kernel. It is important to remember that this abstraction is, unlike a virtual machine, very leaky and can potentially damage your host system. Be careful about what you run in the WSL console.