diff --git a/wpa_supplicant/events.c b/wpa_supplicant/events.c
index d09be6c..0b4feb8 100644
--- a/wpa_supplicant/events.c
+++ b/wpa_supplicant/events.c
@@ -2320,6 +2320,27 @@ void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
 				data->assoc_reject.status_code);
 		if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME)
 			sme_event_assoc_reject(wpa_s, data);
+		else if (wpa_s->assoc_retries++ < 3) {
+			/*
+			 * If association reject is reported by the driver,
+			 * avoid waiting for the authentication timeout. Cancel
+			 * the authentication timeout and retry the
+			 * association.
+			 */
+			wpa_printf(MSG_DEBUG, "Retrying association "
+				   "(iteration %d)", wpa_s->assoc_retries);
+
+			/* Clear the state */
+			wpa_sm_notify_disassoc(wpa_s->wpa);
+			wpa_supplicant_deauthenticate(
+				wpa_s, WLAN_REASON_DEAUTH_LEAVING);
+
+			wpa_s->reassociate = 1;
+			wpas_connection_failed(wpa_s,
+					       data->assoc_reject.bssid);
+		} else {
+			wpa_s->assoc_retries = 0;
+		}
 		break;
 	case EVENT_AUTH_TIMED_OUT:
 		if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME)
diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
index 3cb954d..fdfcc5d 100644
--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
@@ -587,6 +587,9 @@ void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 		wpa_supplicant_state_txt(wpa_s->wpa_state),
 		wpa_supplicant_state_txt(state));
 
+	if (state == WPA_ASSOCIATED || state <= WPA_INACTIVE)
+		wpa_s->assoc_retries = 0;
+
 	if (state != WPA_SCANNING)
 		wpa_supplicant_notify_scanning(wpa_s, 0);
 
@@ -3199,8 +3202,11 @@ void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
 	 * either not available or has already been tried, so that we can start
 	 * increasing the delay here to avoid constant scanning.
 	 */
-	count = wpa_blacklist_add(wpa_s, bssid);
-	if (count == 1 && wpa_s->current_bss) {
+	if (bssid)
+		count = wpa_blacklist_add(wpa_s, bssid);
+	else
+		count = 3;
+	if (count == 1 && wpa_s->current_bss && bssid) {
 		/*
 		 * This BSS was not in the blacklist before. If there is
 		 * another BSS available for the same ESS, we should try that
diff --git a/wpa_supplicant/wpa_supplicant_i.h b/wpa_supplicant/wpa_supplicant_i.h
index 84e8fa4..50eef00 100644
--- a/wpa_supplicant/wpa_supplicant_i.h
+++ b/wpa_supplicant/wpa_supplicant_i.h
@@ -286,6 +286,7 @@ struct wpa_supplicant {
 	struct wpa_bss *current_bss;
 	int ap_ies_from_associnfo;
 	unsigned int assoc_freq;
+	unsigned int assoc_retries;
 
 	/* Selected configuration (based on Beacon/ProbeResp WPA IE) */
 	int pairwise_cipher;