--- net/wireless/scan.c

+++ net/wireless/scan.c

@@ -270,6 +270,7 @@ struct cfg80211_bss *cfg80211_get_bss(st

{

struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);

struct cfg80211_internal_bss *bss, *res = NULL;

+ unsigned long now = jiffies;

spin_lock_bh(&dev->bss_lock);

@@ -278,6 +279,10 @@ struct cfg80211_bss *cfg80211_get_bss(st

continue;

if (channel && bss->pub.channel != channel)

continue;

+ /* Don't get expired BSS structs */

+ if (time_after(now, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE) &&

+ !atomic_read(&bss->hold))

+ continue;

if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {

res = bss;

kref_get(&res->ref);