bool no_cck;
        bool pass_all;
        int n_match_sets;
+       struct iwl_scan_probe_req preq;
        struct cfg80211_match_set *match_sets;
        struct _dwell {
                u16 passive;
 static void
 iwl_mvm_build_scan_probe(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                         struct ieee80211_scan_ies *ies,
-                        struct iwl_scan_probe_req *preq,
-                        const u8 *mac_addr, const u8 *mac_addr_mask)
+                        struct iwl_mvm_scan_params *params)
 {
-       struct ieee80211_mgmt *frame = (struct ieee80211_mgmt *)preq->buf;
+       struct ieee80211_mgmt *frame = (void *)params->preq.buf;
        u8 *pos, *newpos;
+       const u8 *mac_addr = params->flags & NL80211_SCAN_FLAG_RANDOM_ADDR ?
+               params->mac_addr : NULL;
 
        /*
         * Unfortunately, right now the offload scan doesn't support randomising
         * random, only when it's restarted, but at least that helps a bit.
         */
        if (mac_addr)
-               get_random_mask_addr(frame->sa, mac_addr, mac_addr_mask);
+               get_random_mask_addr(frame->sa, mac_addr,
+                                    params->mac_addr_mask);
        else
                memcpy(frame->sa, vif->addr, ETH_ALEN);
 
        *pos++ = WLAN_EID_SSID;
        *pos++ = 0;
 
-       preq->mac_header.offset = 0;
-       preq->mac_header.len = cpu_to_le16(24 + 2);
+       params->preq.mac_header.offset = 0;
+       params->preq.mac_header.len = cpu_to_le16(24 + 2);
 
        /* Insert ds parameter set element on 2.4 GHz band */
        newpos = iwl_mvm_copy_and_insert_ds_elem(mvm,
                                                 ies->ies[IEEE80211_BAND_2GHZ],
                                                 ies->len[IEEE80211_BAND_2GHZ],
                                                 pos);
-       preq->band_data[0].offset = cpu_to_le16(pos - preq->buf);
-       preq->band_data[0].len = cpu_to_le16(newpos - pos);
+       params->preq.band_data[0].offset = cpu_to_le16(pos - params->preq.buf);
+       params->preq.band_data[0].len = cpu_to_le16(newpos - pos);
        pos = newpos;
 
        memcpy(pos, ies->ies[IEEE80211_BAND_5GHZ],
               ies->len[IEEE80211_BAND_5GHZ]);
-       preq->band_data[1].offset = cpu_to_le16(pos - preq->buf);
-       preq->band_data[1].len = cpu_to_le16(ies->len[IEEE80211_BAND_5GHZ]);
+       params->preq.band_data[1].offset = cpu_to_le16(pos - params->preq.buf);
+       params->preq.band_data[1].len =
+               cpu_to_le16(ies->len[IEEE80211_BAND_5GHZ]);
        pos += ies->len[IEEE80211_BAND_5GHZ];
 
        memcpy(pos, ies->common_ies, ies->common_ie_len);
-       preq->common_data.offset = cpu_to_le16(pos - preq->buf);
-       preq->common_data.len = cpu_to_le16(ies->common_ie_len);
+       params->preq.common_data.offset = cpu_to_le16(pos - params->preq.buf);
+       params->preq.common_data.len = cpu_to_le16(ies->common_ie_len);
 }
 
 static void
 }
 
 static int iwl_mvm_scan_lmac(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
-                            struct ieee80211_scan_ies *ies,
                             struct iwl_mvm_scan_params *params)
 {
        struct iwl_scan_req_lmac *cmd = mvm->scan_cmd;
-       struct iwl_scan_probe_req *preq;
+       struct iwl_scan_probe_req *preq =
+               (void *)(cmd->data + sizeof(struct iwl_scan_channel_cfg_lmac) *
+                        mvm->fw->ucode_capa.n_scan_channels);
        u32 flags = 0, ssid_bitmap = 0;
 
        lockdep_assert_held(&mvm->mutex);
        iwl_mvm_lmac_scan_cfg_channels(mvm, params->channels,
                                       params->n_channels, ssid_bitmap, cmd);
 
-       preq = (void *)(cmd->data + sizeof(struct iwl_scan_channel_cfg_lmac) *
-                       mvm->fw->ucode_capa.n_scan_channels);
-
-       iwl_mvm_build_scan_probe(mvm, vif, ies, preq,
-               params->flags & NL80211_SCAN_FLAG_RANDOM_ADDR ?
-                       params->mac_addr : NULL,
-               params->mac_addr_mask);
+       *preq = params->preq;
 
        return 0;
 }
 
 static int
 iwl_mvm_sched_scan_lmac(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
-                       struct ieee80211_scan_ies *ies,
-                       struct iwl_mvm_scan_params *params)
+                                  struct iwl_mvm_scan_params *params)
 {
        struct iwl_scan_req_lmac *cmd = mvm->scan_cmd;
-       struct iwl_scan_probe_req *preq;
+       struct iwl_scan_probe_req *preq =
+               (void *)(cmd->data + sizeof(struct iwl_scan_channel_cfg_lmac) *
+                        mvm->fw->ucode_capa.n_scan_channels);
        u32 flags = 0, ssid_bitmap = 0;
 
        lockdep_assert_held(&mvm->mutex);
        iwl_mvm_lmac_scan_cfg_channels(mvm, params->channels,
                                       params->n_channels, ssid_bitmap, cmd);
 
-       preq = (void *)(cmd->data + sizeof(struct iwl_scan_channel_cfg_lmac) *
-                       mvm->fw->ucode_capa.n_scan_channels);
-
-       iwl_mvm_build_scan_probe(mvm, vif, ies, preq,
-               params->flags & NL80211_SCAN_FLAG_RANDOM_ADDR ?
-                       params->mac_addr : NULL,
-               params->mac_addr_mask);
+       *preq = params->preq;
 
        return 0;
 }
 }
 
 static int iwl_mvm_scan_umac(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
-                            struct ieee80211_scan_ies *ies,
                             struct iwl_mvm_scan_params *params)
 {
        struct iwl_scan_req_umac *cmd = mvm->scan_cmd;
 
        sec_part->schedule[0].iter_count = 1;
        sec_part->delay = 0;
-
-       iwl_mvm_build_scan_probe(mvm, vif, ies, &sec_part->preq,
-               params->flags & NL80211_SCAN_FLAG_RANDOM_ADDR ?
-                       params->mac_addr : NULL,
-               params->mac_addr_mask);
+       sec_part->preq = params->preq;
 
        return 0;
 }
 
 static int iwl_mvm_sched_scan_umac(struct iwl_mvm *mvm,
                                   struct ieee80211_vif *vif,
-                                  struct ieee80211_scan_ies *ies,
                                   struct iwl_mvm_scan_params *params)
 {
        struct iwl_scan_req_umac *cmd = mvm->scan_cmd;
                sec_part->delay = cpu_to_le16(params->delay);
        }
 
-       iwl_mvm_build_scan_probe(mvm, vif, ies, &sec_part->preq,
-               params->flags & NL80211_SCAN_FLAG_RANDOM_ADDR ?
-                       params->mac_addr : NULL,
-               params->mac_addr_mask);
+       sec_part->preq = params->preq;
 
        return 0;
 }
 
        iwl_mvm_scan_calc_dwell(mvm, vif, ¶ms);
 
+       iwl_mvm_build_scan_probe(mvm, vif, ies, ¶ms);
+
        if (mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_UMAC_SCAN) {
                hcmd.id = SCAN_REQ_UMAC;
-               ret = iwl_mvm_scan_umac(mvm, vif, ies, ¶ms);
+               ret = iwl_mvm_scan_umac(mvm, vif, ¶ms);
        } else {
                hcmd.id = SCAN_OFFLOAD_REQUEST_CMD;
-               ret = iwl_mvm_scan_lmac(mvm, vif, ies, ¶ms);
+               ret = iwl_mvm_scan_lmac(mvm, vif, ¶ms);
        }
 
        if (ret)
        if (ret)
                return ret;
 
+       iwl_mvm_build_scan_probe(mvm, vif, ies, ¶ms);
+
        if (mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_UMAC_SCAN) {
                hcmd.id = SCAN_REQ_UMAC;
-               ret = iwl_mvm_sched_scan_umac(mvm, vif, ies, ¶ms);
+               ret = iwl_mvm_sched_scan_umac(mvm, vif, ¶ms);
        } else {
                hcmd.id = SCAN_OFFLOAD_REQUEST_CMD;
-               ret = iwl_mvm_sched_scan_lmac(mvm, vif, ies, ¶ms);
+               ret = iwl_mvm_sched_scan_lmac(mvm, vif, ¶ms);
        }
 
        if (ret)