diff --git a/components/mbedtls/port/aes/block/esp_aes.c b/components/mbedtls/port/aes/block/esp_aes.c
index 7978cbd26a22..fcf4e2a67b77 100644
--- a/components/mbedtls/port/aes/block/esp_aes.c
+++ b/components/mbedtls/port/aes/block/esp_aes.c
@@ -153,7 +153,7 @@ int esp_internal_aes_encrypt(esp_aes_context *ctx,
                              const unsigned char input[16],
                              unsigned char output[16] )
 {
-    int r;
+    int r = -1;
 
     if (esp_aes_validate_input(ctx, input, output)) {
         return MBEDTLS_ERR_AES_BAD_INPUT_DATA;
@@ -186,7 +186,7 @@ int esp_internal_aes_decrypt(esp_aes_context *ctx,
                              const unsigned char input[16],
                              unsigned char output[16] )
 {
-    int r;
+    int r = -1;
 
     if (esp_aes_validate_input(ctx, input, output)) {
         return MBEDTLS_ERR_AES_BAD_INPUT_DATA;
@@ -212,7 +212,7 @@ int esp_aes_crypt_ecb(esp_aes_context *ctx,
                       const unsigned char input[16],
                       unsigned char output[16] )
 {
-    int r;
+    int r = -1;
 
     if (esp_aes_validate_input(ctx, input, output)) {
         return MBEDTLS_ERR_AES_BAD_INPUT_DATA;
diff --git a/components/mbedtls/port/aes/dma/esp_aes.c b/components/mbedtls/port/aes/dma/esp_aes.c
index 476d9c2cd91c..2e3e61942ac7 100644
--- a/components/mbedtls/port/aes/dma/esp_aes.c
+++ b/components/mbedtls/port/aes/dma/esp_aes.c
@@ -642,7 +642,7 @@ int esp_internal_aes_encrypt(esp_aes_context *ctx,
                              const unsigned char input[16],
                              unsigned char output[16] )
 {
-    int r;
+    int r = -1;
 
     if (esp_aes_validate_input(ctx, input, output)) {
         return MBEDTLS_ERR_AES_BAD_INPUT_DATA;
@@ -676,7 +676,7 @@ int esp_internal_aes_decrypt(esp_aes_context *ctx,
                              const unsigned char input[16],
                              unsigned char output[16] )
 {
-    int r;
+    int r = -1;
 
     if (esp_aes_validate_input(ctx, input, output)) {
         return MBEDTLS_ERR_AES_BAD_INPUT_DATA;
@@ -712,7 +712,7 @@ int esp_aes_crypt_ecb(esp_aes_context *ctx,
                       const unsigned char input[16],
                       unsigned char output[16] )
 {
-    int r;
+    int r = -1;
 
     if (esp_aes_validate_input(ctx, input, output)) {
         return MBEDTLS_ERR_AES_BAD_INPUT_DATA;
@@ -742,7 +742,7 @@ int esp_aes_crypt_cbc(esp_aes_context *ctx,
                       const unsigned char *input,
                       unsigned char *output )
 {
-    int r = 0;
+    int r = -1;
     if (esp_aes_validate_input(ctx, input, output)) {
         return MBEDTLS_ERR_AES_BAD_INPUT_DATA;
     }
@@ -771,13 +771,13 @@ int esp_aes_crypt_cbc(esp_aes_context *ctx,
 
     r = esp_aes_process_dma(ctx, input, output, length, NULL);
     if (r != 0) {
-        esp_aes_release_hardware();
-        return r;
+        goto cleanup;
     }
 
     aes_hal_read_iv(iv);
-    esp_aes_release_hardware();
 
+cleanup:
+    esp_aes_release_hardware();
     return r;
 }
 
@@ -791,9 +791,9 @@ int esp_aes_crypt_cfb8(esp_aes_context *ctx,
                        const unsigned char *input,
                        unsigned char *output )
 {
+    int r = -1;
     unsigned char c;
     unsigned char ov[17];
-    int r = 0;
     size_t block_bytes = length - (length % AES_BLOCK_BYTES);
 
     if (esp_aes_validate_input(ctx, input, output)) {
@@ -823,8 +823,7 @@ int esp_aes_crypt_cfb8(esp_aes_context *ctx,
         aes_hal_set_iv(iv);
         r = esp_aes_process_dma(ctx, input, output, block_bytes, NULL);
         if (r != 0) {
-            esp_aes_release_hardware();
-            return r;
+            goto cleanup;
         }
 
         aes_hal_read_iv(iv);
@@ -845,8 +844,7 @@ int esp_aes_crypt_cfb8(esp_aes_context *ctx,
 
             r = esp_aes_process_dma(ctx, iv, iv, AES_BLOCK_BYTES, NULL);
             if (r != 0) {
-                esp_aes_release_hardware();
-                return r;
+                goto cleanup;
             }
 
             if ( mode == MBEDTLS_AES_DECRYPT ) {
@@ -862,8 +860,10 @@ int esp_aes_crypt_cfb8(esp_aes_context *ctx,
         }
 
     }
-    esp_aes_release_hardware();
+    r = 0;
 
+cleanup:
+    esp_aes_release_hardware();
     return r;
 }
 
@@ -880,7 +880,6 @@ int esp_aes_crypt_cfb128(esp_aes_context *ctx,
 
 {
     uint8_t c;
-    int r = 0;
     size_t stream_bytes = 0;
     size_t n;
 
@@ -928,7 +927,7 @@ int esp_aes_crypt_cfb128(esp_aes_context *ctx,
         aes_hal_mode_init(ESP_AES_BLOCK_MODE_CFB128);
         aes_hal_set_iv(iv);
 
-        r = esp_aes_process_dma(ctx, input, output, length, iv);
+        int r = esp_aes_process_dma(ctx, input, output, length, iv);
         if (r != 0) {
             esp_aes_release_hardware();
             return r;
@@ -951,7 +950,7 @@ int esp_aes_crypt_cfb128(esp_aes_context *ctx,
     }
 
     *iv_off = n + stream_bytes;
-    return r;
+    return 0;
 }
 
 /*
@@ -965,7 +964,6 @@ int esp_aes_crypt_ofb(esp_aes_context *ctx,
                       const unsigned char *input,
                       unsigned char *output )
 {
-    int r = 0;
     size_t n;
     size_t stream_bytes = 0;
 
@@ -1001,7 +999,7 @@ int esp_aes_crypt_ofb(esp_aes_context *ctx,
         aes_hal_mode_init(ESP_AES_BLOCK_MODE_OFB);
         aes_hal_set_iv(iv);
 
-        r = esp_aes_process_dma(ctx, input, output, length, iv);
+        int r = esp_aes_process_dma(ctx, input, output, length, iv);
         if (r != 0) {
             esp_aes_release_hardware();
             return r;
@@ -1013,7 +1011,7 @@ int esp_aes_crypt_ofb(esp_aes_context *ctx,
 
     *iv_off = n + stream_bytes;
 
-    return r;
+    return 0;
 }
 
 /*
@@ -1027,7 +1025,6 @@ int esp_aes_crypt_ctr(esp_aes_context *ctx,
                       const unsigned char *input,
                       unsigned char *output )
 {
-    int r = 0;
     size_t n;
 
     if (esp_aes_validate_input(ctx, input, output)) {
@@ -1072,7 +1069,7 @@ int esp_aes_crypt_ctr(esp_aes_context *ctx,
         aes_hal_mode_init(ESP_AES_BLOCK_MODE_CTR);
         aes_hal_set_iv(nonce_counter);
 
-        r = esp_aes_process_dma(ctx, input, output, length, stream_block);
+        int r = esp_aes_process_dma(ctx, input, output, length, stream_block);
 
         if (r != 0) {
             esp_aes_release_hardware();
@@ -1086,7 +1083,7 @@ int esp_aes_crypt_ctr(esp_aes_context *ctx,
     }
     *nc_off = n + (length % AES_BLOCK_BYTES);
 
-    return r;
+    return 0;
 }
 
 static bool s_check_dma_capable(const void *p)