This writing is based on Linux kernel 2.6.21.5.

If skb is linear (i.e., skb->data_len == 0), the length of skb->data is skb->len.

If skb is not linear (i.e., skb->data_len != 0), the length of skb->data is (skb->len) - (skb->data_len) for the head ONLY. The rest must see struct skb_shared_info->frags[i].size and struct skb_shared_info->frag_list, which contains a linked-list of struct sk_buff because, deducing from [2],

skb->data_len =
  struct skb_shared_info->frags[0...struct skb_shared_info->nr_frags].size
  +
  size of data in struct skb_shared_info->frag_list

The rest of the data is not stored as a separate skb if the length of the data permits, but as an array of struct skb_frag_struct in struct skb_shared_info ([4]: To allow 64K frame to be packed as single skb without frag_list). struct skb_frag_struct contains struct page * to point to the true data. If the length of the data is longer than that that can be contained in the array, struct skb_shared_info->frag_list will be used to contain a linked-list of struct sk_buff (i.e., the data undergo fragmentation because, according to [1], the frag_list is used to maintain a chain of SKBs organized for fragmentation purposes, it is not used for maintaining paged data.)

As an additional information, skb->truesize = skb->len + sizeof(struct sk_buff). Don't forget that skb->len contains the length of the total data space that the skb refers to taking into account SKB_DATA_ALIGN() and non-linear condition.

skb->len is modified when doing skb_pull(), skb_push() or skb_put().

References:
[1] DaveM's skb_data.html (http://vger.kernel.org/~davem/skb_data.html)
[2] ip_frag_reasm() in ip_fragment.c
[3] __alloc_skb(), pskb_copy() in skbuff.c
[4] include/linux/skbuff.h

Archive: Linux Kernel's Networking Part (skb)