--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
@@ -1248,7 +1248,7 @@ static int wpa_supplicant_get_scan_resul
 {
 #define SCAN_AP_LIMIT 128
 	struct wpa_scan_result *results;
-	int num, i;
+	int num, i, j;
 	struct wpa_scan_results *res;
 
 	results = os_malloc(SCAN_AP_LIMIT * sizeof(struct wpa_scan_result));
@@ -1345,6 +1345,21 @@ static int wpa_supplicant_get_scan_resul
 		res->res[res->num++] = r;
 	}
 
+	/* sort scan results by quality */
+	for(i = 0; i < num - 1; i++) {
+		for(j = i + 1; j < num; j++) {
+			struct wpa_scan_result tmp;
+
+			if (results[i].qual > results[j].qual)
+				continue;
+
+			os_memcpy(&tmp, &results[i], sizeof(tmp));
+			os_memcpy(&results[i], &results[j], sizeof(tmp));
+			os_memcpy(&results[j], &tmp, sizeof(tmp));
+		}
+	}
+
+
 	os_free(results);
 	wpa_s->scan_res = res;