1 files changed, 8 insertions, 6 deletions

diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 94be5dbb2569..0889949b6896 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -2487,8 +2487,10 @@ done:
 
                         pi->remote_mps = le16_to_cpu(rfc.max_pdu_size);
 
-                        rfc.retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
-                        rfc.monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
+                        rfc.retrans_timeout =
+                                le16_to_cpu(L2CAP_DEFAULT_RETRANS_TO);
+                        rfc.monitor_timeout =
+                                le16_to_cpu(L2CAP_DEFAULT_MONITOR_TO);
 
                         pi->conf_state |= L2CAP_CONF_MODE_DONE;
 
@@ -2578,8 +2580,8 @@ static int l2cap_parse_conf_rsp(struct sock *sk, void *rsp, int len, void *data,
                 switch (rfc.mode) {
                 case L2CAP_MODE_ERTM:
                         pi->remote_tx_win   = rfc.txwin_size;
-                        pi->retrans_timeout = rfc.retrans_timeout;
-                        pi->monitor_timeout = rfc.monitor_timeout;
+                        pi->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
+                        pi->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
                         pi->mps    = le16_to_cpu(rfc.max_pdu_size);
                         break;
                 case L2CAP_MODE_STREAMING:
@@ -2634,8 +2636,8 @@ done:
         switch (rfc.mode) {
         case L2CAP_MODE_ERTM:
                 pi->remote_tx_win   = rfc.txwin_size;
-                pi->retrans_timeout = rfc.retrans_timeout;
-                pi->monitor_timeout = rfc.monitor_timeout;
+                pi->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
+                pi->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
                 pi->mps    = le16_to_cpu(rfc.max_pdu_size);
                 break;
         case L2CAP_MODE_STREAMING: