diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index 76a80a41615b..a967da647e2b 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -609,19 +609,26 @@ void wireless_send_event(struct net_device *	dev,
 
 	compat_event->len = event_len;
 	compat_event->cmd = cmd;
+
+	/* kernel reserves event_len's bytes for compat_event,
+	 * so we don't need memcpy()'s bounds check
+	 */
 	if (descr->header_type == IW_HEADER_TYPE_POINT) {
 		compat_wrqu.length = wrqu->data.length;
 		compat_wrqu.flags = wrqu->data.flags;
-		memcpy(&compat_event->pointer,
+		unsafe_memcpy(&compat_event->pointer,
 			((char *) &compat_wrqu) + IW_EV_COMPAT_POINT_OFF,
-			hdr_len - IW_EV_COMPAT_LCP_LEN);
+			hdr_len - IW_EV_COMPAT_LCP_LEN,
+			/* compat_event has enough room */);
 		if (extra_len)
-			memcpy(((char *) compat_event) + hdr_len,
-				extra, extra_len);
+			unsafe_memcpy(((char *) compat_event) + hdr_len,
+				extra, extra_len,
+				/* compat_event has enough room */);
 	} else {
 		/* extra_len must be zero, so no if (extra) needed */
-		memcpy(&compat_event->pointer, wrqu,
-			hdr_len - IW_EV_COMPAT_LCP_LEN);
+		unsafe_memcpy(&compat_event->pointer, wrqu,
+			hdr_len - IW_EV_COMPAT_LCP_LEN,
+			/* compat_event has enough room */);
 	}
 
 	nlmsg_end(compskb, nlh);