santa-driver: Fix rare panic in CacheCheck where lock upgrade fails.

lck_rw_lock_shared_to_exclusive can return false if a previous reader upgraded. The result is the lock being unlocked and the panic is caused when unlocking a lock that isn't locked.

Conf/Package/Makefile

@@ -13,14 +13,14 @@ TITLE:=santa
 REVERSE_DOMAIN:=com.google
 
 # Get latest Release version using the GitHub API. Each release is bound to a
-# git tag, which should always be a semantic version number
+# git tag, which should always be a semantic version number. The most recent
+# release is always first in the API result.
 PACKAGE_VERSION:=$(shell curl -fs https://api.github.com/repos/google/santa/releases |\
 	python -c 'import json, sys; print json.load(sys.stdin)[0]["tag_name"]' 2>/dev/null)
 
-# Get the download URL for the latest Release using the GitHub API. Each release
-# should have a single 'asset' which will be a tar.bz2 containing all of the files
-# associated with that release.
-# The tarball layout is:
+# Get the download URL for the latest Release. Each release should have a
+# tarball named santa-$version.tar.bz2 containing all of the files associated
+# with that release. The tarball layout is:
 #
 #   santa-$version.tar.bz2
 #   +--santa-$version
@@ -40,9 +40,7 @@ PACKAGE_VERSION:=$(shell curl -fs https://api.github.com/repos/google/santa/rele
 #             |-- Santa.app.dSYM
 #             |-- santad.dSYM
 #             +-- santactl.dSYM
-#
-PACKAGE_DOWNLOAD_URL:=$(shell curl -fs https://api.github.com/repos/google/santa/releases |\
-	python -c 'import json, sys; print json.load(sys.stdin)[0]["assets"][0]["browser_download_url"]' 2>/dev/null)
+PACKAGE_DOWNLOAD_URL:="https://github.com/google/santa/releases/download/${PACKAGE_VERSION}/santa-${PACKAGE_VERSION}.tar.bz2"
 
 PAYLOAD:=pack-usr-libexec-santad \
 	pack-usr-sbin-santactl \
@@ -66,9 +64,8 @@ com.google.santa.asl.conf: download
 
 download:
 	$(if $(PACKAGE_VERSION),, $(error GitHub API returned unexpected result. Wait a while and try again))
-	$(if $(PACKAGE_DOWNLOAD_URL),, $(error GitHub API returned unexpected result. Wait a while and try again))
 
-	@curl-fL ${PACKAGE_DOWNLOAD_URL} | tar xvj --strip=2
+	@curl -fL ${PACKAGE_DOWNLOAD_URL} | tar xvj --strip=2
 	@rm -rf *.dSYM
 
 pack-usr-libexec-santad: santad l_usr

Source/santa-driver/SantaDecisionManager.cc

@@ -185,7 +185,12 @@ void SantaDecisionManager::CacheCheck(const char *identifier) {
   lck_rw_lock_shared(cached_decisions_lock_);
   bool shouldInvalidate = (cached_decisions_->getObject(identifier) != NULL);
   if (shouldInvalidate) {
-    lck_rw_lock_shared_to_exclusive(cached_decisions_lock_);
+    if (!lck_rw_lock_shared_to_exclusive(cached_decisions_lock_)) {
+      // shared_to_exclusive will return false if a previous reader upgraded
+      // and if that happens the lock will have been unlocked. If that happens,
+      // which is rare, relock exclusively.
+      lck_rw_lock_exclusive(cached_decisions_lock_);
+    }
     cached_decisions_->removeObject(identifier);
     lck_rw_unlock_exclusive(cached_decisions_lock_);
   } else {
@@ -282,7 +287,7 @@ santa_action_t SantaDecisionManager::GetFromDaemon(
     CacheCheck(vnode_id_str);
     return ACTION_ERROR;
   }
-  
+
   return return_action;
 }