125

According to Wikipedia, the following is a very elegant bash fork bomb:

:(){ :|:& };:

How does it work?

Lajos Nagy
  • 9,075
  • 11
  • 44
  • 55
  • 57
    :(){ :|:& };: doesn't mean that UNIX is obscure. Just because it allows you to write obscure things doesn't mean it is obscure when used properly. I could write some pretty damn F-ed up sentences in English, but I can write some easy to understand ones too. – c4757p Jun 21 '09 at 14:39
  • 11
    @c4757p case in point: "Buffalo buffalo Buffalo buffalo buffalo buffalo Buffalo buffalo" is a grammatically correct sentence in American English (http://en.wikipedia.org/wiki/Buffalo_buffalo_Buffalo_buffalo_buffalo_buffalo_Buffalo_buffalo) – tomfumb Jun 27 '13 at 00:00
  • 2
    There's a good explanation here of how the fork bomb works: [http://www.cyberciti.biz/faq/understanding-bash-fork-bomb/](http://www.cyberciti.biz/faq/understanding-bash-fork-bomb/) Unfortunately, it is littered with smilies, I've uploaded it here in plain text also: [http://pbin.oogly.co.uk/listings/viewlistingdetail/7e9399079ac13111492326d01ed16d](http://pbin.oogly.co.uk/listings/viewlistingdetail/7e9399079ac13111492326d01ed16d) Enjoy, it's a good read. – Jonathan Holloway Jun 13 '09 at 17:48
  • https://explainshell.com/explain?cmd=%3A%28%29%7B+%3A+%7C+%3A%26+%7D%3B+%3A – Tom M Sep 20 '18 at 08:16
  • https://unix.stackexchange.com/questions/283496/why-do-these-bash-fork-bombs-work-differently-and-what-is-the-significance-of/283576#283576 this might help if you want to understand more – Aayush Neupane Jun 18 '21 at 08:59
  • [Wikipedia link](https://en.wikipedia.org/wiki/Fork_bomb) – A-Tech Mar 30 '23 at 14:11

2 Answers2

166

Breaking it down, there are three big pieces:

:()      # Defines a function, ":". It takes no arguments.
{ ... }; # The body of the function.
:        # Invoke the function ":" that was just defined.

Inside the body, the function is invoked twice and the pipeline is backgrounded; each successive invocation on the processes spawns even more calls to ":". This leads rapidly to an explosive consumption in system resources, grinding things to a halt.

Note that invoking it once, infinitely recursing, wouldn't be good enough, since that would just lead to a stack overflow on the original process, which is messy but can be dealt with.

A more human-friendly version looks like this:

kablammo() {             # Declaration
  kablammo | kablammo&   # The problematic body.
}; kablammo              # End function definition; invoke function.

Edit: William's comment below was a better wording of what I said above, so I've edited to incorporate that suggestion.

John Feminella
  • 303,634
  • 46
  • 339
  • 357
  • 9
    ...and, kablammo! – SuPra Jun 13 '09 at 17:50
  • 2
    Just make sure you stand clear of the blast when your system goes up in smoke! – John Feminella Jun 24 '09 at 02:01
  • 9
    Minor nit: "the function is invoked twice and an instance is backgrounded" is not quite right. The function is invoked twice in a pipeline and the pipe is backgrounded, so both instances are being run in the background. Although that's a semantic detail as in reality it is likely that only one is ever attempted, and its recursion halts the system before the other ever starts. – William Pursell Aug 28 '09 at 12:03
  • @William: Thanks! I've modified my answer to reflect your correction. – John Feminella Aug 28 '09 at 13:32
  • 4
    @william: "its recursion halts the system before the other ever starts", so does that mean that :(){ :& };: would work as a bomb too? – Dan Nov 16 '09 at 05:22
  • 7
    @Dan: Unlikely, because it would terminate immediately after creating its child process. The big ingredient you need is that the fork bomb not terminate so that the total number of processes grows over time rather than holding steady. – R.. GitHub STOP HELPING ICE Apr 29 '11 at 19:09
  • 1
    @WilliamPursell: If only one is ever attempted, then why does `sleep 5 | echo bye` print "bye" immediately and then wait for 5 seconds? Doesn't that suggest that this would actually create exponential process growth, as suggested by [Ben Voigt](http://stackoverflow.com/users/103167/ben-voigt) in a comment to [this answer](http://stackoverflow.com/a/515923/2093695) on SO? – Brian McCutchon Aug 01 '15 at 04:39
9

Short answer:

The colon (":") becomes a function, so you are running the function piped to the function and putting it in the backgroun which means for every invocation of the function 2 copies of the function are invoked. Recursion takes hold.

Talljoe
  • 14,593
  • 4
  • 43
  • 39