Memory handling with struct epoll_event

Everything is fine. The epoll_ctl function is a simple wrapper around a system call which will be entirely complete when the function returns. No further data from userspace is required. The struct is simply a way to package the arguments.

It's absolutely fine to immediately throw away or reuse your epoll_event struct.

The kernel will copy the parameters out of the epoll_event struct.

This is exactly the same as if you used an ioctl which takes a struct as a parameter, or a socket operation (e.g. bind) which takes a struct sockaddr_in.

The kernel takes what it needs, and it's immediately ok for you to free it.

The only thing you need to worry about is the "user data", which is only relevant to you. The kernel will store it, but you need to know what it means when you get an event.

epoll is a set of syscalls, not a library. When you call the epoll syscalls you enter the kernel, and the kernel generally doesn't trust these user mode buffers to necessarily be valid or stick around, but rather copies into kernel memory via copy_from_user etc. So yes, you can set up structs on the stack, pass their addresses to the syscall, then discard them after it returns.