diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 08bfbb0f09265d5fe9a5475f5b766bc66d7ab2a2..2694a0a6186daec737d9345128a22ff9ac881659 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -714,18 +714,18 @@ static int hidp_session(void *arg)
 				intr_sk->sk_state != BT_CONNECTED)
 			break;
 
-		while ((skb = skb_dequeue(&ctrl_sk->sk_receive_queue))) {
+		while ((skb = skb_dequeue(&intr_sk->sk_receive_queue))) {
 			skb_orphan(skb);
 			if (!skb_linearize(skb))
-				hidp_recv_ctrl_frame(session, skb);
+				hidp_recv_intr_frame(session, skb);
 			else
 				kfree_skb(skb);
 		}
 
-		while ((skb = skb_dequeue(&intr_sk->sk_receive_queue))) {
+		while ((skb = skb_dequeue(&ctrl_sk->sk_receive_queue))) {
 			skb_orphan(skb);
 			if (!skb_linearize(skb))
-				hidp_recv_intr_frame(session, skb);
+				hidp_recv_ctrl_frame(session, skb);
 			else
 				kfree_skb(skb);
 		}